Computerized system for simulating the likelihood of technology change incidents

ABSTRACT

Embodiments of the present invention relate to apparatuses, systems, methods and computer program products for a technology configuration system. Specifically, the system typically provides operational data processing of a plurality of records associated with information technology operational activities, for dynamic transformation of data and evaluation of interdependencies of technology resources. In other aspects, the system typically provides technical language processing of the plurality of records for transforming technical and descriptive data, and constructing categorical activity records. The system may be configured to achieve significant reduction in memory storage and processing requirements by performing categorical data encoding of the plurality of records. The system may employ a dynamic categorical data decoding process, which delivers a reduction in processing time when the encoded records are decoded for evaluating the exposure of technology change events to technology incidents and modifying such technology change events.

FIELD

In general, embodiments of the invention are directed to a system thatperforms technical language processing of records associated withinformation technology operational activities. The system may performoperational data processing of the records in order to evaluate theinformation technology operational activities and the technologyresources associated with the activities. The system may transformdescriptive data of the plurality of records, determineinterdependencies of the activities, and construct categorical activityrecords. Furthermore, the system may provide improved data storage andretrieval processes, by performing categorical data encoding of theplurality of records that drastically reduces the memory requirementsfor storage of the records. The system may utilize a dynamic datadecoding process for retrieval and evaluation of the records, withreduced processing time.

BACKGROUND

With advancements in technology, entities have increasingly embraced amultitude of information technology resources, in an attempt toadminister an ever increasing number of information technologyoperational activities that are necessary for the functioning of theentities. However, processing, storing and analyzing the massive amountsof data associated with the information technology operationalactivities and the information technology resources using existingsystems is challenging, both from technical and feasibility standpoints.Furthermore, existing systems and technology are inept at evaluating thedisparate information data regarding technology resources and theirinterdependencies, which are vital for evaluation, configuration, andimplementation of the associated information technology operationalactivities. Thus, there is a need for technical solutions whichalleviate the deficiencies of the existing systems and provide novelsystems for systematic data processing, evaluation of data associatedwith information technology operational activities and data compressionfor storage.

The previous discussion of the background to the invention is providedfor illustrative purposes only and is not an acknowledgement oradmission that any of the material referred to is or was part of thecommon general knowledge as at the priority date of the application.

BRIEF SUMMARY

Embodiments of the present invention address the above needs and/orachieve other advantages by providing a computerized system, and anassociated method and computer program product, for systematic dataprocessing and technology configuration. Specifically, the systemprovides operational data processing, evaluation of interdependencies ofinformation technology operational activities of an entity, technicallanguage processing of activity records, categorical data encoding,dynamic data decoding, evaluation of technology stability, evaluation ofthe likelihood of technology change incidents, evaluation of the impactof technology change incidents, and/or modification of technology changeincidents. In some embodiments the system comprises a computer apparatusincluding at least one processor, at least one memory device and anetwork communication device. In some embodiments, one or more modulesare stored in the at least one memory device comprising computerreadable instructions, that when executed by the at least one processor,cause the at least one processor to perform operational data processing,technical language processing, categorical data encoding, dynamic datadecoding, and/or technology change evaluation.

In some embodiments, the system is configured for operational dataprocessing and data interdependency evaluation, wherein the computerizedsystem provides an operational data processor module configured forevaluation, modification and quality control of data associated withinformation technology operational activities. In this regard, thesystem is configured to: retrieve a plurality of records regarding aplurality of information technology operational activities from anactivity record database, wherein each record comprises a plurality oftechnology elements associated with one of the plurality of informationtechnology operational activities, wherein at least one technologyelement of the plurality of technology elements of each of the recordsis associated with at least one technology resource; identify a firstrecord of the plurality of records, associated with a first informationtechnology operational activity, wherein the first record comprises aplurality of first technology elements associated with the firstinformation technology operational activity; parse the plurality ofrecords to identify at least one second record associated with at leastone second information technology operational activity, wherein the atleast one second record comprises at least one second technology elementthat is similar to at least one of the plurality of first technologyelements; determine a relationship between the first informationtechnology operational activity and the at least one second informationtechnology operational activity, wherein determining the relationshipcomprises (i) determining that that the first information technologyoperational activity is a cause of the second information technologyoperational activity, (ii) determining that at least one technologyresource associated with the first information technology operationalactivity is influenced by the second information technology operationalactivity, and/or (iii) determining that at least one technology resourceassociated with the first information technology operational activityand at least one technology resource associated with the secondinformation technology operational activity has a similar operationshift; update the first record with the determined relationship betweenthe first information technology operational activity and the at leastone second information technology operational activity; and initiatetransmission of an alert to a user device, wherein the alert comprises apresentation of the determined relationship between the firstinformation technology operational activity and the at least one secondinformation technology operational activity.

In some embodiments, or in combination with any of the previousembodiments, the system is further configured for technical languageprocessing, wherein the computerized system provides a technicallanguage processor module configured for establishing technical andcategorical context associated with data regarding informationtechnology operational activities. In this regard, the system is furtherconfigured to retrieve a first record regarding a first informationtechnology operational activity from an activity record database,wherein the first record comprises a plurality of technology elementsassociated with the first information technology operational activity,wherein the first record is associated with at least one technologyresource; parse the first record to identify at least one technologymotivator, wherein the technology motivator is associated withinitiating the first information technology operational activityregarding the at least one technology resource; determine one or moretechnology actions that are associated with the at least one technologyresource and the at least one technology motivator, wherein each of theone or more technology actions is associated with at least one actionterm; determine at least one technology action of the one or moretechnology actions associated with the first record, based onidentifying the at least one action term associated with the at leastone technology action in the first record; determine a categoricalcontext associated with the first information technology operationalactivity based on the at least one technology resource, the at least onetechnology motivator, and the at least one technology action; constructa new activity record associated with the first information technologyoperational activity, wherein the new activity record comprises aplurality of data fields associated with a plurality of technologyidentifiers retrieved from a categorical context database; and store thenew activity record associated with the first information technologyoperational activity in the activity record database.

In some embodiments, or in combination with any of the previousembodiments, the system is further configured for systematic dataprocessing, wherein the computerized system provides a technicallanguage processor module configured for storage, maintenance andretrieval of data associated with information technology operationalactivities. In this regard, the system is further configured to: receivea retrieval request for retrieving one or more records from an activityrecord database from a user device, wherein the activity record databasecomprises a plurality of records, each record of the plurality ofrecords being associated with a plurality of data fields comprisingtechnology identifier data associated with an information technologyoperational activity, wherein the retrieval request comprises one ormore technology search terms; determine a first retrieval rule based onthe one or more technology search terms and technology language rulesretrieved from a categorical context database, wherein the firstretrieval rule is configured for retrieving the one or more recordsassociated with the retrieval request; retrieve the one or more firstrecords of the plurality of records from the activity record databasebased on the first retrieval rule; and based on determining that atleast one record of the one or more first records is not associated withthe retrieval request, (i) modify the technology language rulesretrieved from the categorical context database, (ii) modify the firstretrieval rule and retrieve one or more second records of the pluralityof records based on the modified retrieval rule, and/or (iii) determinea second retrieval rule based on the one or more technology search termsand retrieve one or more second records of the plurality of recordsbased on the second retrieval rule.

In some embodiments, or in combination with any of the previousembodiments, the system is further configured for categorical dataencoding, wherein the computerized system provides a data encodingmodule configured for systematic compression of data associated withinformation technology operational activities to reduce storagerequirements. In this regard, the system is configured to: retrieve aplurality of records regarding a plurality of information technologyoperational activities from an activity record database, wherein eachrecord of the plurality of records is associated with a plurality ofdata fields comprising technology identifier data associated with aninformation technology operational activity; determine, for each recordof the plurality of records, one or more first data fields and one ormore second data fields of the plurality of data fields; transform, foreach data field of the plurality of data fields, the technologyidentifier data into a binary value; encode using a categorical dataencoding algorithm, for each record of the plurality of records, thebinary values associated with the plurality of data fields into one ormore encoded words, each encoded word comprising a predetermined numberof characters; store an encoded record, for each record of the pluralityof records, in the activity record database, wherein the encoded recordcomprises the one or more encoded words corresponding to the pluralityof data fields associated with the record regarding the informationtechnology operational activity; and discard the plurality of recordsregarding the plurality of information technology operational activitiesfrom an activity record database.

In some embodiments, or in combination with any of the previousembodiments, the system is further configured for dynamic categoricaldata decoding, wherein the computerized system provides a data decodingmodule configured for dynamic decoding and retrieval of encoded dataassociated with information technology operational activities. In thisregard, the system is further configured to: receive a retrieval requestfor retrieving one or more records from an activity record database froma user device, wherein the activity record database comprises aplurality of encoded records, each encoded record of the plurality ofencoded records comprising one or more encoded words associated with atechnology operational activity, wherein the retrieval request comprisesone or more technology criteria terms; determine a decoding divisorbased on the one or more technology criteria terms, wherein the decodingdivisor is common to the one or more encoded records of the plurality ofencoded records that correspond to the one or more technology criteriaterms; retrieve the one or more encoded records of the plurality ofrecords based on the decoding divisor, wherein the encoded wordsassociated with the one or more encoded records are divisible by thedecoding divisor; decode, using a categorical data decoding algorithm,for each of the one or more encoded records into one or more decodedrecords, each of the decoded records being associated with a pluralityof data fields comprising binary values regarding the informationtechnology operational activity; and transform, for each decoded recordof the one or more decoded record, the binary value associated with atleast one data field of the plurality of data fields into technologyidentifier data.

In some embodiments, or in combination with any of the previousembodiments, the system is further configured for dynamic categoricaldata decoding, wherein the computerized system is configured to decodeand create contextual displays of encoded data associated withinformation technology operational activities. In this regard, thesystem is further configured to: receive a retrieval request forretrieving one or more records from an activity record database from auser device, wherein the activity record database comprises a pluralityof encoded records, each encoded record of the plurality of encodedrecords comprising one or more encoded words associated with atechnology operational activity, wherein the retrieval request comprisesone or more technology criteria terms; determine a numeric value foreach term of the one or more technology criteria terms; determine adecoding divisor by combining the one or more numeric values associatedwith the one or more technology criteria terms, wherein the decodingdivisor is common to the encoded words of one or more encoded records ofthe plurality of encoded records that correspond to the one or moretechnology criteria terms; retrieve the one or more encoded records ofthe plurality of records based on the decoding divisor, wherein theencoded words associated with the one or more encoded records aredivisible by the decoding divisor; determine counts of technologyidentifier data associated with the one or more retrieved records;generate one or more technology interfaces comprising the technologyidentifier data associated with the one or more retrieved records, basedon the determined counts; and transmit control instructions to the userdevice to cause the user device to present the one or more technologyinterfaces on a display of the user device.

In some embodiments, or in combination with any of the previousembodiments, the system is further configured for evaluating technologystability, wherein the computerized system is configured to determineoperational impact of technology incidents. In this regard, the systemis further configured to: retrieve a plurality of records regarding aplurality of technology incidents from an activity record database,wherein each record of the plurality of records is associated with aplurality of data fields comprising technology identifier dataassociated with a technology incident of the plurality of technologyincidents; determine, for each technology incident of the plurality oftechnology incidents, an operational impact caused by the technologyincident, based on at least analyzing a portion of the plurality of datafields; determine, for each technology incident of the plurality oftechnology incidents, an impact factor based at least on the operationalimpact; augment, the technology identifier data of each record of theplurality of records with the determined impact factor; transform, foreach record, the technology identifier data of the plurality of datafields into a binary value; encode using a categorical data encodingalgorithm, for each record of the plurality of records, the binaryvalues associated with the plurality of data fields into one or moreencoded words, each encoded word comprising a predetermined number ofcharacters; and store an encoded record, for each record of theplurality of records, in the activity record database, wherein theencoded record comprises the one or more encoded words corresponding tothe plurality of data fields associated with the technology incident.

In some embodiments, or in combination with any of the previousembodiments, the system is further configured for evaluating thelikelihood of technology change incidents, comprising. In this regard,the system is configured for: retrieving a plurality of encoded recordsregarding a plurality of historic information technology operationalactivities from an activity record database; decoding each of theplurality of encoded records into a plurality of decoded records, eachof the decoded records comprising a binary value in each of a pluralityof data fields, the plurality of data fields including a first datafield defining whether one of the historic information technologyoperational activities is associated with a prior technology incident;processing the decoded records using a technology incident predictivemodel to produce an incident predictive algorithm for predicting whethera technology change event will cause a technology incident, the incidentpredictive algorithm defining a subset of the data fields and a weightfactor for each data field in the subset of the data fields; retrievinga change record related to a future technology change event, the changerecord comprising change information related to one or more of theplurality of data fields; and evaluating the change information in thechange record using the incident predictive algorithm to determine alikelihood that the future technology change event will cause a futuretechnology incident.

In some embodiments, or in combination with any of the previousembodiments, the system is further configured for evaluating the impactof technology change incidents. In this regard, the system is configuredfor: retrieving a plurality of encoded records regarding a plurality ofhistoric information technology operational activities from an activityrecord database; decoding each of the plurality of encoded records intoa plurality of decoded records, each of the decoded records comprising abinary value in each of a plurality of data fields, the plurality ofdata fields including a first data field defining whether one of thehistoric information technology operational activities is associatedwith a prior technology incident; processing the decoded records using atechnology incident predictive model to produce an incident predictivealgorithm for predicting whether a technology change event will cause atechnology incident, the incident predictive algorithm defining a subsetof the data fields and a weight factor for each data field in the subsetof the data fields; retrieving a change record (the change record may berelated to a future technology change event in some instances), thechange record comprising change information related to one or more ofthe plurality of data fields; evaluating the change information in thechange record using the incident predictive algorithm to determine alikelihood that the future technology change event will cause a futuretechnology incident; determining an impact of the future technologyincident; and determining an exposure index associated with the futuretechnology change event, the exposure index being equal to thelikelihood that the future technology change event will cause the futuretechnology incident multiplied by the impact of the future technologyincident.

In some embodiments, or in combination with any of the previousembodiments, the system is further configured for evaluating andmodifying technology change events. In this regard, the system isconfigured for: retrieving a plurality of encoded records regarding aplurality of historic information technology operational activities froman activity record database; decoding each of the plurality of encodedrecords into a plurality of decoded records, each of the decoded recordscomprising a binary value in each of a plurality of data fields, theplurality of data fields including a first data field defining whetherone of the historic information technology operational activities isassociated with a prior technology incident; processing the decodedrecords using a technology incident predictive model to produce anincident predictive algorithm for predicting whether a technology changeevent will cause a technology incident, the incident predictivealgorithm defining a subset of the data fields and a weight factor foreach data field in the subset of the data fields; retrieving a pluralityof change records, each change record being related to one of aplurality of future technology change events, each change recordcomprising change information related to one or more of the plurality ofdata fields, the change records comprising timing information related tothe future technology change events; evaluating the change informationin the change records using the incident predictive algorithm todetermine a likelihood that each of the future technology change eventswill cause a future technology incident; determining an impact of eachfuture technology incident; determining an exposure index for each ofthe plurality of future technology change events based on (i)determining a likelihood that each of the future technology changeevents will cause a future technology incident and (ii) determining animpact of each future technology incident; aggregating the exposureindices of the plurality of future technology change events to determinean aggregate exposure index for each of a plurality of time periodsbased on the timing information related to the future technology changeevents; determining whether the aggregate exposure index for each of theplurality of time periods exceeds a predefined aggregate exposure levelthreshold; and prompting a user computing device to display a graphicaluser interface, the graphical user interface being configured to displayinformation regarding whether the aggregate exposure index for each ofthe plurality of time periods exceeds the predefined aggregate exposurelevel threshold.

In some embodiments, or in combination with any of the previousembodiments, the system is further configured for simulating thelikelihood of technology change incidents. In this regard, the system isconfigured for: retrieving a plurality of encoded records regarding aplurality of historic information technology operational activities froman activity record database; decoding each of the plurality of encodedrecords into a plurality of decoded records, each of the decoded recordscomprising a binary value in each of a plurality of data fields, theplurality of data fields including a first data field defining whetherone of the historic information technology operational activities isassociated with a prior technology incident; processing the decodedrecords using a technology incident predictive model to produce anincident predictive algorithm for predicting whether a technology changeevent will cause a technology incident, the incident predictivealgorithm defining a subset of the data fields and a weight factor foreach data field in the subset of the data fields; retrieving a pluralityof change records, each change record being related to one of aplurality of future technology change events, each change recordcomprising change information related to one or more of the plurality ofdata fields, the change records comprising timing information related tothe future technology change events; evaluating the change informationin the change records using the incident predictive algorithm todetermine a likelihood that each of the future technology change eventswill cause a future technology incident; determining an impact of eachfuture technology incident; determining an exposure index for each ofthe plurality of future technology change events based on (i)determining a likelihood that each of the future technology changeevents will cause a future technology incident and (ii) determining animpact of each future technology incident; aggregating the exposureindices of the plurality of future technology change events to determinean aggregate exposure index for each of a plurality of time periodsbased on the timing information related to the future technology changeevents; receiving a request from a user computing device to simulate achange to the timing information related to the future technology changeevents; determining a simulated aggregate exposure index for each of theplurality of time periods based on (i) the exposure indices for each ofthe plurality of future technology change events and (ii) the change tothe timing information related to the future technology change events;determining whether the simulated aggregate exposure index for each ofthe plurality of time periods exceeds a predefined aggregate exposurelevel threshold; and prompting the user computing device to display agraphical user interface, the graphical user interface being configuredto display information regarding whether the simulated aggregateexposure index for each of the plurality of time periods exceeds thepredefined aggregate exposure level threshold.

In some embodiments, or in combination with any of the previousembodiments, the incident predictive algorithm defines an aggregateweight factor for the subset of the data fields; the plurality ofdecoded records are associated with a first time period; the technologychange evaluation module is configured for incrementally altering thefirst time period to identify a second time period that correlates withthe first data field, the second time period being associated with asubset of the plurality of decoded records; processing the decodedrecords using the technology incident predictive model to produce theincident predictive algorithm comprises: processing the subset of theplurality of decoded records using the technology incident predictivemodel to produce the incident predictive algorithm; performing a fieldselection test to identify the subset of the data fields, the subset ofthe data fields correlating with the first data field; performing afield weight test to identify the weight factor for each data field inthe subset of data fields, each weight factor correlating with the firstdata field; and performing an aggregate weight test to identify theaggregate weight factor for the subset of the data fields, the aggregateweight factor correlating with the first data field.

In some embodiments, or in combination with any of the previousembodiments, the technology change evaluation module is configured for:identifying historic technology change events having characteristics incommon with the future technology change event; determining a mostfrequent impact of prior technology incidents associated with thehistoric technology change events; wherein the impact of the futuretechnology incident is the most frequent impact of the prior technologyincidents associated with the historic technology change events.

In some embodiments, or in combination with any of the previousembodiments, the technology change evaluation module is configured for:identifying historic technology change events having characteristics incommon with the future technology change event; determining a highestimpact of prior technology incidents associated with the historictechnology change events; wherein the impact of the future technologyincident is the highest impact of the prior technology incidentsassociated with the historic technology change events.

In some embodiments, or in combination with any of the previousembodiments, the technology change evaluation module is configured for:receiving a user request via the graphical user interface to implementthe change to the timing information related to the future technologychange events; automatically altering the timing information containedin the change records related to the future technology change eventsbased on the change to the timing information related to the futuretechnology change events.

In some embodiments, or in combination with any of the previousembodiments, the technology change evaluation module is configured for:receiving a user selection via the graphical user interface of a firsttime period; based on the change to the timing information related tothe future technology change events, determining one or more firstfuture technology change events simulated to occur during the first timeperiod; determining that the exposure index of one or more of the firstfuture technology change events exceeds a predefined exposure levelthreshold; and prompting the user computing device to display via thegraphical user interface information indicating that the exposure indexof the one or more first future technology change events exceeds thepredefined exposure level threshold.

The features, functions, and advantages that have been discussed may beachieved independently in various embodiments of the present inventionor may be combined with yet other embodiments, further details of whichcan be seen with reference to the following description and drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

Having thus described embodiments of the invention in general terms,reference will be made to the accompanying drawings, where:

FIG. 1 illustrates a block diagram of the system environment 100 fortechnology configuration;

FIG. 2A illustrates a high level process flow 200A for systematic dataprocessing of data associated with information technology operationalactivities, by an operational data processor;

FIG. 2B illustrates a high level process flow 200B directed to datatransformation of data associated with information technologyoperational activities, by an operational data processor;

FIG. 3 illustrates a high level process flow 300 for systematictechnical language processing of data associated with informationtechnology operational activities, by an technical language processor;

FIG. 4 illustrates a high level process flow 400 directed to systematictechnical language processing for storage, maintenance and retrieval ofdata associated with information technology operational activities;

FIG. 5 illustrates a high level process flow 500 for categorical dataencoding of data associated with information technology operationalactivities;

FIG. 6 illustrates a high level process flow 600 for categorical dynamicdata encoding of encoded data associated with information technologyoperational activities;

FIG. 7A illustrates a high level process flow 700A for categoricaldynamic data encoding of encoded data and creation of contextual visualdisplays associated with information technology operational activities;

FIG. 7B illustrates a user interface for contextual visual displays in atechnology interface 700B associated with information technologyoperational activities;

FIG. 8 illustrates a high level process flow 800 for evaluatingtechnology stability;

FIG. 9A illustrates a high level process flow 900 for evaluating thelikelihood of technology change incidents by building an incidentpredictive algorithm using a technology incident predictive model;

FIG. 9B illustrates a field selection test for one instance of theincident predictive algorithm of FIG. 9A;

FIG. 10 illustrates a high level process flow 1000 for evaluating impactand determining an exposure index associated with a particular futuretechnology change event;

FIG. 11 illustrates a high level process flow 1100 for determining theexposure to potential technology incidents during different timeperiods;

FIG. 12 illustrates a high level process flow 1200 for simulatingchanges to future technology change events;

FIG. 13 illustrates a graphical user interface including a calendarrepresentation of aggregate exposure levels; and

FIG. 14 illustrates a graphical user interface including arepresentation of aggregate exposure levels for various time periods.

DETAILED DESCRIPTION OF THE INVENTION

Embodiments of the present invention may now may be described more fullyhereinafter with reference to the accompanying drawings, in which some,but not all, embodiments of the invention are shown. Indeed, theinvention may be embodied in many different forms and should not beconstrued as limited to the embodiments set forth herein; rather, theseembodiments are provided so that this disclosure may satisfy applicablelegal requirements. Like numbers refer to like elements throughout.

In some embodiments, a “user” may be an individual associated with anenterprise or entity. In some embodiments, a “user” may be an employee(e.g., an associate, a project manager, an IT specialist, a manager, anadministrator, an internal operations analyst, or the like) of theentity or enterprises affiliated with the entity, capable of operatingthe system described herein. In some embodiments, a “user” may be anyindividual or entity who has a relationship with the enterprise. Forpurposes of this invention, the terms “user” and “customer” may be usedinterchangeably. In some embodiments, a “user” may be a customer of theenterprise. In one aspect, a user may be a system performing one or moretasks described herein.

In some embodiments, an “entity” or “enterprise” as used herein may beany institution employing information technology resources. In someembodiments the enterprise may be any institution, group, association,business, financial institution, club, establishment, company, union,authority or the like, employing information technology resources.

As used herein, a “user interface” may be a graphical user interface.Typically, a graphical user interface (GUI) is a type of interface thatallows users to interact with electronic devices such as graphical iconsand visual indicators such as secondary notation, as opposed to usingonly text via the command line. In some embodiments, the graphical userinterface may include both graphical elements and text elements.

Typically, an entity or enterprise is associated with a plurality ofinformation technology operational activities. The “informationtechnology operational activities,” as referred to herein, may compriseany activities, operations, transactions, technology change activities,technology incidents, actions and events associated with day-to dayfunctioning of an entity, operations and control activities oftechnology resources of the entity, external networks of the entity,activities performed/initiated by employees, affiliates and customers ofthe entity, and the like. In some embodiments, the informationtechnology operational activities may comprise operational activitiesassociated with system hardware, operating systems, servers, technologyapplications, internal networks, storage/databases, user interfaces,authentication operations, middleware, software program products,external networks, software applications, hosting/facilities,business/technology processes, electrical infrastructure, and othertechnology resources or technology assets associated with the entity. Insome embodiments, the information technology operational activities maybe associated with transactional activities of the enterprise,comprising technology changes, technology events, technology maintenanceactivities, technology incidents, technology problems, technologyreleases, technology service requests, technology projects,configuration activities, technology resource/asset managementactivities, vendor transactions and the like. In some embodiments, theplurality of information technology operational activities may comprisetechnology change events/activities and technology incidents. As usedherein, the term “event” relates to a discrete modification, addition,or deletion of a business asset, system, process, product, or the like.Exemplary events may include installing new hardware in an existingentity system, updating software used by the entity, implementing aprocedural change to a business process, rolling out a new product orservice, or updating the entity's website. As used herein, the term“change” relates to any program, project, or event related to themodification, addition, deletion of one or more business assets,systems, processes, products, or the like. The term “technology change”refers to any technology related change. The technology involved in atechnology change may include computer hardware or software.

Technology change events typically comprise intended modifications tothe structure or functioning of one or more technology resources.Technology change events may comprise changing/modifying the operatingsystem of a server, updating the versions of one or moresecurity/authentication applications of a processor, performing hardwarechanges, addition of networking capabilities, hardware/softwarereconfiguration with/without restart, servicing, or otherwise modifyingone or more aspects of the technology resources. Technology incidents ortechnology incident activities may comprise variation in functioning oftechnology resources (reduction in capacity, slowdown in processingspeeds, and the like) notifications, alerts, errors, pause/stops inprocesses, and the like. In some embodiments, technology incidents maybe caused or triggered by the implementation of technology changeevents. The technology incidents caused by technology changes may bereferred to a technology change incidents.

In general, each information technology operational activity of theplurality of activities, is associated with a “record” comprisingdata/information regarding the activity. This record may be directed todescribing, recording, identifying and/or documenting the activity.Although referred to as “a record”, it is understood that, in someembodiments each information technology operational activity may beassociated with multiple records. In some embodiments, each record mayfurther comprise a plurality of technology elements comprising dataassociated with the information technology operational activity. In thisregard, each of the plurality of technology elements may comprise dataassociated with one or more aspects of the information technologyoperational activity, comprising but not limited to, technologyresources/infrastructure involved, activity target, time, location,applications involved, type of activity, person/system thatinitiated/performed the activity, and/or other aspects. Furthermore, thetechnology elements may by discrete components of the record, or thetechnology elements may merely refer to one or more portions of a singledata component in a record. For example, the record may comprise asentence or phrase describing the activity. Here, each individualtechnology element may refer to one or more words in thesentence/phrase. As another example, the record may be in the form of adata object comprising discrete elements, for example, a row of aspreadsheet comprising information associated with various technologyelements in various columns or a data object/class comprising variablesdirected to specific technology elements. The records may comprisedescriptive data, textual data, unformatted data, formatted data, or anyother available forms of data/information or a combination of forms. Therecords may be transformed, formatted, encoded, decoded, or otherwisefundamentally altered during storage, retrieval, data/languageprocessing, and other operations, as will be described in detail lateron.

FIG. 1 illustrates a technology configuration system environment 100, inaccordance with one embodiment of the present invention. As illustratedin FIG. 1, the technology configuration system 106 is operativelycoupled, via a network 101 to technology resources 150, the technologydatabase 108, the user system/device 104, and to the third party system160. The system environment 100 is described in detail, elsewhere inthis disclosure.

In some embodiments, the data associated with the information technologyoperational activities, may be generated by the technology configurationsystem 106, by technology resources 150, and/or other external or thirdparty systems 160. For example, the system 106 may establish operativecommunication channels with the technology resources 150, via thenetwork 101. The system 106 may identify an information technologyoperational activity associated with a first resource and construct afirst record for the information technology operational activity,including one or more technology elements comprising data identifyingthe first resource, time stamp of the activity and the like. Continuingwith the example, in some embodiments, the system 106 may further causethe first resource, other technology resources and the technologydatabase 108 to transmit additional information about the informationtechnology operational activity, for example, location of the firstresource, applications associated with the resource and the like. Thesystem 106 may augment the first record with additional technologyelements comprising the received additional information.

In other embodiments, the records, the technology elements and/or thedata associated with the technology elements may be provided by users102 using the user device 104. As described previously, the user 102 mayrefer to employees, technical subject matter experts, operators andother personnel associated with the entity or affiliates of the entity.As an illustration, a user 102 may create a record identifying theserver/system hardware 151 associated with an application update(activity) initiated by the user 102. In some embodiments, the system106 or another system, may augment this record provided by the user 102,for example, by adding a timestamp technology element.

The plurality of records regarding the plurality of informationtechnology activities are typically stored in an activity recorddatabase. The activity record database may be a part of, or may beassociated with the technology database 108. In some embodiments therecords from the activity record database may be retrieved or accessedbased on satisfying requisite authentication/authorization requirements.However, it is contemplated that some or all of the plurality of recordsmay be stored in other memory locations/devices, for example, memorydevice 140, the user device 104, technology resources 150 and the like.

Often, the plurality of records regarding the plurality of informationtechnology activities constructed by the system 106 or other systems,and the records provided by the user 102, compriseinconsistent/erroneous data, incomplete data, and other data defects.These records may also lack complete information about the informationtechnology operational activity, or are deficient in data describingspecific aspects of the activity required for further actions, sincethis information may not be provided by/available to the systems or theusers creating the records. Typically, these records include descriptivedata with words, phrases and sentences about the activity. However, thedata provided by the systems/the users, that is stored in the record,often includes technical terms, syntax, abbreviations, acronyms andterminology that is unique to the system/the user. Furthermore, theformat, construction and context of the information in the record may beunique to the system/user that provided it, and therefore notcomprehensible by other systems. For example, an activity record may beentered by a system or a technology expert merely stating “Maintenance3DNS”. As another example, another record may read, “Alert fired 2200EST. Checked web service from 2100 to 2300.” Conventional systems areinept at evaluating such disparate information, much less determining acategorical context for each record and determining relationshipsbetween the technology resources involved and the records themselves.The present invention provides a novel system 106 that is configured toperform systematic data processing, decipher technical terminology,correct data defects and construct categorical data records, whichalleviates the above concerns. These processes are described in detailthroughout this disclosure, and with respect to operational dataprocessing of FIGS. 2A and 2B, technical language processing of FIG. 3,and technical language administration of FIG. 4, in particular.

Typically, an entity or enterprise is associated with a large number ofinformation technology operational activities, for example, hundreds,thousands or millions of information technology operational activities.The records associated with these large number of activities constitutemassive amounts of data that are required to be stored and processed,placing strains on the technology resources available to the entity.Storing these plurality of records requires enormous memory capacity andprocessing of the records requires large processing power. Furthermore,processing the records, for example, retrieving records is often timeconsuming, since data from a large number of records is required to beread, decoded and compared before determining pertinent records. Thepresent invention offers an improvement to existing technology byproviding unique categorical encoding by system 106 that is configuredto create encoded records with large compression ratios like 1000:1,thereby drastically reducing the memory requirements for storage,described with respect to categorical data encoding of FIG. 5. Inanother aspect of the invention, the system 106 provides novel dynamiccategorical decoding that significantly reduces the processing powerrequired to search and retrieve pertinent records, since the methodprecludes the need to read each record, as described with respectcategorical dynamic data decoding of FIGS. 6, 7A and 7B. The presentinvention provides yet another improvement over existing systems, byidentifying interdependencies of the large number of informationtechnology operational activities and the interdependencies oftechnology resources. This enables the system 106 to accuratelyevaluate, modify and ascertain the impact of technology changeincidents, described in detail elsewhere in this disclosure.Specifically, the evaluation of interdependencies of informationtechnology operational activities, technical language processing ofrecords, building categorical data records, evaluating technologystability, evaluating the likelihood of technology change incidents,impact of technology change incidents, and/or modifying technologychange incidents, will be described in detail later on with respect toFIGS. 8 through 12.

FIG. 1 illustrates a technology configuration system environment 100, inaccordance with one embodiment of the present invention, configured forevaluation of interdependencies of information technology operationalactivities of an entity, technical language processing of activityrecords, building categorical data records, categorical data encoding,dynamic data decoding, evaluating technology stability, evaluating thelikelihood of technology change incidents, evaluating impact oftechnology change incidents, and/or modifying technology changeincidents. As illustrated in FIG. 1, the technology configuration system106 is operatively coupled, via a network 101 to technology resources150, the technology database 108, the user system/device 104, and to thethird party system 160. In this way, the technology configuration system106 can send information to, and receive information from the technologyresources 150, the technology database 108, the user system 104 and thethird party system 160 to provide operational data processing, technicallanguage processing, categorical data encoding/decoding and technologychange evaluation for a plurality of information technology operationalactivities of an entity. FIG. 1 illustrates only one example of anembodiment of the technology configuration system environment 100, andit will be appreciated that in other embodiments one or more of thesystems, devices, or servers may be combined into a single system,device, or server, or be made up of multiple systems, devices, orservers.

The network 101 may be a global area network (GAN), such as theInternet, a wide area network (WAN), a local area network (LAN), nearfield communication network, audio/radio communication network,ultra-high frequency wireless communication network, or any other typeof network or combination of networks. The network 101 may provide forwireline, wireless, or a combination wireline and wireless communicationbetween devices on the network 101.

In some embodiments, the user 102 is an individual associated with theentity. In some embodiments, the user 102 may access the technologyconfiguration system 106 through an interface comprising a webpage or auser technology application 122. Hereinafter, “user technologyapplication” is used to refer to an application on the user system 104of a user, a widget, a webpage accessed through a browser, and the like.In some embodiments the user technology application 122 is a user systemapplication stored on the user system 104. In some embodiments the usertechnology application may refer to a third party application or a userapplication stored on a cloud used to access the technologyconfiguration system through a network. In some embodiments, at least aportion of the user technology application 122 is stored on the memorydevice 140 of the technology configuration system 106. The user 102 maysubsequently navigate through the interface, retrieve one or moreactivity records, provide confirmation, or review presented informationusing a user system 104.

FIG. 1 also illustrates the user system 104. The user system 104generally comprises a communication device 110, a display device 112, aprocessing device 114, and a memory device 116. The user system 104 is acomputing system that allows a user 102 to interact with the technologyconfiguration system to configure, monitor or control informationtechnology operational activities of the entity. The processing device114 is operatively coupled to the communication device 110, the displaydevice 112, and the memory device 116. The processing device 114 usesthe communication device 110 to communicate with the network 101 andother devices on the network 101, such as, but not limited to the thirdparty system 160 and the technology configuration system 106. As such,the communication device 110 generally comprises a modem, server, orother device for communicating with other systems/devices on the network101. In some embodiments the network 101 comprises a network ofdistributed servers.

The user system 104 comprises computer-readable instructions 120 storedin the memory device 116/data storage, which in one embodiment includesthe computer-readable instructions 120 of the user technologyapplication 122. In this way, a user 102 may remotely communicate withthe technology configuration system, view retrieved data and visualdisplays, and/or modify the implementation of information technologyoperational activities using the user system 104. The user system 104may be, for example, a desktop personal computer, a mobile system, suchas a cellular phone, smart phone, personal data assistant (PDA), laptop,or the like. Although only a single user system 104 is depicted in FIG.1, the system environment 100 may contain numerous user systems 104.

As further illustrated in FIG. 1, the technology configuration system106 generally comprises a communication device 136, a processing device138, and a memory device 140. As used herein, the term “processingdevice” generally includes circuitry used for implementing thecommunication and/or logic functions of the particular system. Forexample, a processing device may include a digital signal processordevice, a microprocessor device, and various analog-to-digitalconverters, digital-to-analog converters, and other support circuitsand/or combinations of the foregoing. Control and signal processingfunctions of the system are allocated between these processing devicesaccording to their respective capabilities. The processing device mayinclude functionality to operate one or more software programs or one ormore modules, based on computer-readable instructions thereof, which maybe stored in a memory device.

The processing device 138 is operatively coupled to the communicationdevice 136 and the memory device 140. The processing device 138 uses thecommunication device 136 to communicate with the network 101 and otherdevices on the network 101, such as, but not limited to the technologydatabase 108, the third party system 160 and the user system 104. Assuch, the communication device 136 generally comprises a modem, server,or other device for communicating with other devices on the network 101.

As further illustrated in FIG. 1, the technology configuration system106 comprises computer-readable instructions 142 stored in the memorydevice 140, which in one embodiment includes the computer-readableinstructions 142 of an operational data processor module 144 configuredfor systematic data processing of a plurality of information technologyoperational activities. The technology configuration system 106 mayfurther comprise computer-readable instructions 142 for a technicallanguage processor module 145 configured for systematic technicallanguage processing of a plurality of information technology operationalactivity records. In some embodiments, the technology configurationsystem 106 may further comprise computer-readable instructions 142 for acategorical data encoding module 146 configured for categorical dataencoding. In some embodiments, the technology configuration system 106may further comprise computer-readable instructions 142 for a dynamicdata decoding module 147 configured for categorical dynamic datadecoding of a plurality of encoded records. In some embodiments, thetechnology configuration system 106 may further comprisecomputer-readable instructions 142 for a technology change evaluationmodule 148 configured for evaluating technology stability of activities,evaluating the likelihood of technology change incidents, evaluatingimpact of technology change incidents, and/or modifying technologychange incidents. In some embodiments, the memory device 140 includesdata storage (not illustrated) for storing data related to informationtechnology operational activities, but not limited to data createdand/or used by the modules 144 to 148. Although illustrated as separatemodules, in some embodiments, the computer-readable instructions 142 forall the modules 144 to 148, may be contained in one or more of the abovemodules.

As further illustrated by FIG. 1, the system environment 100 furthercomprises a technology database 108. The technology database 108 may bedirected to a memory storage technology resource, a memory location ordata storage comprising an activity record database, a data qualitydatabase, an inference database, a categorical context database, and thelike, as will be described in detail elsewhere in this disclosure. Thesystem environment 100 further comprises technology resources 150comprising system hardware 151, technology devices and applications 152,operating systems, servers, technology applications, internal networks,storage/databases 153, user interfaces, authentication operations,middleware, program products, external networks, hosting/facilities,business/technology processes, and other technology resources ortechnology assets associated with the entity. In some embodiments, thetechnology configuration system 106 communicates with the individualtechnology resources 150, via established operative communicationchannels. In this regard, the system 106 may transmit controlinstructions that cause the technology resources 150 to perform one ormore actions, provide activity data, and the like. The technologyresources 150 are typically configured to communicate with one another,other devices operated by the entity, and devices operated by thirdparties (e.g., customers), such as a third party computing device 160,via a network 101. Technology change activities performed on onetechnology resource may cause a technology incident/issue on the sametechnology resource or other technology resources, by the virtue oftheir interdependencies.

Operational Data Processing

FIG. 2A illustrates a high level process flow 200A configured forsystematic data processing by an operational data processor. Some or allof the steps associated with the process flow 200A may be performed bythe system 106, either alone or in combination with the technologyresources 150, technology database 108, user device 104 and otherdevices/systems. Typically, the system 106 comprises an operational dataprocessor module 144, stored in at least one memory device 140,configured for evaluation, modification and quality control of dataassociated with information technology operational activities. In someembodiments, the system 106 comprises at least one processor 138configured to execute computer readable instructions associated with theoperational data processor module 144, for one or more steps of processflow 200A. Executing the instructions in the operational data processormodule 144 (and/or other modules within the technology configurationsystem 106) may cause the system 106, hereinafter referred to as “thesystem” to perform one or more steps described below with respect toprocess flow 200A.

In some embodiments, the operational data processing of a plurality ofrecords regarding a plurality of information technology operationalactivities is configured to identify, evaluate and establish therelationships between two or more information technology operationalactivities. This evaluation of interdependencies between informationtechnology operational activities is described below with respect todetermination of a relationship between a first activity and at leastone second activity.

Block 202 of process flow 200A, illustrates retrieving a plurality ofrecords regarding a plurality of information technology operationalactivities from an activity record database. As discussed previously,the system may retrieve a plurality of records stored in the activityrecord database of technology database 108, each record being associatedwith at least one information technology operational activity. Eachrecord may comprise a plurality of technology elements related to theassociated information technology operational activity. In this regardthe technology elements may be associated with data related to one ormore aspects of the information technology operational activity,comprising but not limited to, technology resources/infrastructureinvolved, activity target, time, location, applications involved, typeof activity, person/system that initiated/performed the activity, and/orother aspects, as alluded to previously. Typically, each recordcomprises at least one technology element that relates to at least onetechnology resource involved in the information technology operationalactivity. The at least one technology resource involved may be aresource that the activity is performed on, a resource that the activitytargets/affects, a resource initiating the activity, a resourceperforming the activity, and/or any technology resource of the entitythat may otherwise be associated with the information technologyoperational activity of the record. As such, an entity may be associatedwith multiple technology resources/assets/infrastructure, comprising butnot limited to, system hardware, operating systems, servers, technologyapplications, internal networks, processing devices, softwareapplications, databases or other memory/storage devices, userinterfaces, authentication operations, middleware, program products,external networks, hosting/facilities, electrical infrastructure anddevices, business/technology processes, and the like.

Next, at block 204, the system may identify a first record of theplurality or records, wherein the first record comprises a plurality offirst technology elements associated with a first information technologyoperational activity. Furthermore, the first information operationalactivity may be associated with at least one first technology resource,as described previously. Although, the first record and/or the pluralityof records may comprise defective data comprising missing data,incomplete data and/or inconsistent data. For example, the records maynot comprise the at least one technology element that relates to atleast one technology resource, or the data of the at least onetechnology element may be missing, incomplete, and/or inconsistent. Thesystem may then perform one or more data transformation steps directedto identifying data inconsistencies and deficiencies, determininginterdependencies and relationships between technology resources, andmodifying/correcting the records in real-time such that the recordscomprise the requisite data. In this regard, the records are updateddynamically, to ensure that all of the associated technology resourcesand current/latest information technology operational activities areconsidered for evaluation of interdependencies of information technologyoperational activities, technical language processing of records,building categorical data records, evaluating technology stability,evaluating the likelihood of technology change incidents, impact oftechnology change incidents, and/or modifying technology changeincidents, as will be described in detail later on. The datatransformation steps are described with respect to the first record ofthe plurality of records in process flow 200B of FIG. 2B. It should beunderstood that the steps in process flow 200B are indicative of thedata transformation steps that may be performed for some or all of theplurality of records.

Now referring to block 206 of process flow 200A illustrated in FIG. 2A.Here, the system may identify at least one second record of theplurality of records associated with a second information technologyoperational activity, comprising at least one second technology elementsimilar to at least one of the plurality of first technology elements.For example, the first information technology operational activity maybe associated with a technology change operation performed on a firsttechnology resource (for example, a server). In this regard, the firstrecord may comprise technology elements associated with the firsttechnology resource, the first technical function comprising thetechnology change operation, the first physical location of thetechnology resource, first timestamp of the activity, first technologyapplications associated with the first technology resource, firstbusiness/technology processes associated with the first technologyresource, first technology devices and databases associated with thetechnology resource, and the like. The system may parse the plurality ofrecords to identify one or more second records of second informationtechnology operational activities associated with one or more of thefirst technology elements, for instance, second activities involving thefirst technology resource, the first technology applications, the firstbusiness/technology processes, and or a suitable combination of firsttechnology elements. In addition, the system may identify one or moresecond records of second information technology activities beingassociated with the “types” of first technology elements, wherein typesof technology elements refer to technology elements of generic types,specific classes or predetermined categories. For example, the systemmay identify second records of second activities associated with asecond technology resource that is determined to be in the same servercategory as the first technology resource or second technologyapplications, which is configured to perform same/similar functions asthe first technology applications. Therefore, the at least one secondtechnology element being similar to at least one first technologyelement may refer to, the second element being same as the specificfirst element and/or the second element type/category being the same asthe first element type/category.

Subsequently, the system may determine a relationship between the firstinformation technology operational activity and the at least one secondinformation technology operational activity, at block 208. In thisregard, the relationship between the first information technologyoperational activity may comprise (i) the first information technologyoperational activity being a cause of the second information technologyoperational activity, (ii) at least one technology resource associatedwith the first information technology operational activity beinginfluenced by the second information technology operational activity,and/or (iii) at least one technology resource associated with the firstinformation technology operational activity and at least one technologyresource associated with the second information technology operationalactivity having a similar operation shift. Determining the aboverelationships are described in detail below. In some embodiments, thesystem may determine relationships between the first activity and only aportion of the second activities identified previously.

In some embodiments the system may determine that that the firstinformation technology operational activity is a cause of the secondinformation technology operational activity. In this regard, the firstactivity comprising a technology change may cause the second activitycomprising a technology incident, due to prior/scheduled futureimplementation of the change, errors in change development/testing,errors in implementation of the change, type/nature of the change, andthe like. Here, the second activity comprising the technology incidentmay be an intended consequence of the change or may be unwarranted. Forexample, the first information technology operational activity may beassociated with a technology change operation (from example,changing/modifying the operating system of a server, updating theversions of one or more security/authentication applications of theserver, performing hardware changes, addition of networkingcapabilities, hardware/software reconfiguration with/without restart,servicing, or otherwise modifying one or more aspects of the server fromone state to another) performed on a first technology resource (forexample, the server). The at least one second information operationalactivity may comprise activities with incidents associated with secondtechnology elements like technology resources, technology applications,business/technology processes and the like. Typically, at least aportion of the identified second information technology operationalactivities may be determined to have a relationship with the firstactivity. In this regard, the system may analyze each of the recordsassociated with the second activities in conjunction with the firstrecord, to determine whether a relationship exists and the type ofrelationship.

Continuing with the previous example, the system may determine that thefirst activity comprising a technology change may have caused one ormore second activities comprising an incident within a succeedingpredetermined time period or near instantaneously, wherein thepredetermined time may be determined based on the type of change andhistorical activity data. Here, the system may disregard incidents thatoccurred prior to the change implementation. Furthermore, the system maydetermine a relationship between the first and a second activity of theone or more activities, based on identifying that the target technologyresource of the first activity/technology change and the technologyresource causing the second activity/incident are the same.Alternatively, or in addition with the previous instance, the system maydetermine that the first activity/technology change is directed to aproject for improving a certain business/technology process. The systemmay then identify second activities/incidents that are caused by thetechnology change based on determining that the incidents are directedto technology applications that perform the specifiedbusiness/technology process. As another example, the system may identifya first information technology comprising an incident associated with atechnology resource that mandated/triggered a corrective action. Forexample, the incident may be an error, interruption in service, or apredetermined shift/alteration in performance of the technologyresource. Here, the system may then identify second informationtechnology operational activities/changes that were implemented/arescheduled to be implemented to remedy the incident (for example, servicerequests, maintenance tickets, repairs and the like). This determinationmay be similar to that of the previous example, except that in this casethe system may choose second activities such that the incident (firstactivity) predates/precedes the change/corrective measures (secondactivity).

In some embodiments or in combination with the previous embodiments, thesystem may determine a relationship between the first and secondactivities, based on determining that at least one technology resourceassociated with the first information technology operational activity isinfluenced by the second information technology operational activity.This determination may be substantially similar to the examplesdescribed above. As an example, the first activity may be directed to anevent comprising one or more alerts/notifications associated with atechnology resource comprising a specific technology application. Thesystem may identify second activities with business/technology processesthat were active during the duration of the alerts and infer that theimplementation/functioning of the business/technology processes impactedthe specific technology application.

In some embodiments or in combination with the previous embodiments, thesystem may determine a relationship between the first and secondactivities based on determining that at least one technology resourceassociated with the first information technology operational activityand at least one technology resource associated with the secondinformation technology operational activity has a similar operationshift. Operation shift as used herein may refer to predetermined,identified or measured changes/alterations to the functioning of thetechnology resources involved or to the resources themselves. Forexample, the system may identify a first activity comprising an incidentinvolving a first type of problem (for example, a specific type ofimproper functioning of a first technology application, a first errorvalue reported by a resource, reduction in processing speed of a firstresource and the like). The system may then identify one or more secondactivities, wherein the second activity may be directed to same orsimilar problems as the first problem (for example, same type offunctioning as the first technology application, a second error valuewithin a predetermined range of the first value reported by a similarresource, similar reduction in processing speed of a second resource andthe like). Here, the system may determine the relationship of recurringdefects between the first and second activities, based on determiningthat first and the one or more second activities report similarproblems/similar operation that occur periodically, and further inferthat these activities are likely caused by same or similar activities.Similarly, the first and second activities may be related to a certaintype of operation shift comprising a specific improvement. The systemmay identify a relationship between these activities based on inferringthat the improvements are caused by same or similar restoral actions.

Next at block 210 of the process flow 200A, the system may update thefirst record with the determined relationship between the firstinformation technology operational activity and the at least one secondinformation technology operational activity. In this regard, the recordmay be updated in real-time or near-real time. Updating the firstrecord, may comprise adding new technology elements comprising data thatidentifies related second records, specifies the type of relationships,identifies the technology resources affected by the relationship, andthe like. In other instances, the system may augment the first recordwith the relationship information. In some instances, the system mayupdate the records associated with the second information technologyoperational activities determined to be related to the first informationtechnology operational activity. In this regard, the system may augmentthe second records with the pertinent information about the relationshipand the first information technology operational activity.

The system may also initiate transmission of one or more alerts ornotifications to a user device and/or other devices/systems, at block212. Typically, the alert comprises a presentation of datadescribing/identifying the determined relationship(s) and/or anyrequired actions on the display device 112 of the user device 104. Thealerts may comprise audio, visual and/or vibratory notifications. Insome embodiments, transmitting the alerts may further comprise causingthe user device to perform one or more functions. In this regard, thesystem may lock the display of at least a portion of a screen of thedisplay device 112, move/rearrange portions of existing displays on thescreen to accommodate the relationship information, change brightness ofthe screen of the display device 112, until the user 102 performs one ormore predetermined actions/responses. Typically, the alert istransmitted via the network 101, via a local area network, near fieldcommunication, via the internet or any other suitable medium. Forexample, based on determining that the user device is offline or in asuspended state, the system may transmit text alerts/encoded signalsthat cause the user device to connect to a suitable network/turn on sothat the relationship information may be conveyed to the user 102. Insome embodiments, the system may perform the update of block 210 onlyafter receiving a confirmation from the user, following the display ofthe alert. In this regard, the system may update the records only afterreceiving confirmation from a user.

In some embodiments, the user may identify a relationship between afirst record and an at least one second record. The user may provide theuser determined relationship, referred to as a user relationship, to thesystem via the user device. The user relationship may be ascomprehensive or as minimal as the user is capable of providing. Forexample, the user may merely provide two unique activity identifiers andmerely indicate that they are related. As another example, the user mayprovide the type of relationship describing how the activities arerelated and the technology resources affected in addition to the uniqueactivity identifiers. This user relationship information may be a partof the descriptive data in retrieved from the activity record database,or the user may provide the relationship information during operationaldata processing of process flow 200A. The system may designate thereceived records as a first records and as an at least one second recordappropriately. The system may then perform the steps 204-212 similarlyto determine a relationship between the first record and the at leastone second record. The system may confirm the user determinedrelationship if the received user relationship is the same as thedetermined relationship at 208. This may be confirmed if at least one ofthe following is true: (i) the first information technology operationalactivity being a cause of the second information technology operationalactivity, (ii) at least one technology resource associated with thefirst information technology operational activity being influenced bythe second information technology operational activity, and (iii) atleast one technology resource associated with the first informationtechnology operational activity and at least one technology resourceassociated with the second information technology operational activityhaving a similar operation shift. The system may transmit theconfirmation/rejection of the user relationship via the alert of step212. The confirmation may comprise specifics about the confirmedrelationship.

As alluded to previously, the system may perform dynamicmodification/transformation of data associated with the plurality ofrecords stored in the activity record database, as depicted by processflow 200B or FIG. 2B. Although described with respect to the firstrecord, one or more steps of the process flow 200B may be performedsystematically on other records of the plurality of records (forexample, the at least one second record, one or more third records, aportion of the plurality or records, and the like). At block 222, thesystem retrieves the first record regarding the first informationtechnology operational activity from the activity record database. Thefirst record may comprise at least one technology element associatedwith at least one technology resource.

Next, the system may analyze the plurality of the plurality oftechnology elements associated with the first record to identify atleast one defective technology element comprising defective data, atblock 224. In this regard, some or all of the plurality of technologyelements associated with the first record may comprise defective data,and hence may be referred to as defective technology elements. In someinstances, the at least one defective technology element may comprise atleast of the technology elements associated with the at least onetechnology resource, while in other instances the defective technologyelements may not be associated with the existing at least one technologyelements associated with the at least one technology resource. Thedefective data may comprise (i) missing data, (ii) incomplete data,and/or (iii) inconsistent data, and other forms of defects. In someembodiments, defective data may comprise unformatted data, incorrectlyformatted data, data redundancies, repetitive entries and the like. Thedefective data in records may arise due to system errors be the systemsthat created/augmented the records, inadvertent oversights by personnelcreating the records, or lack of availability of/access to pertinentinformation for the systems/users creating the records.

Missing data may refer to missing/absent technology elements that aredetermined to be related to the existing technology elements,missing/absent technology element types (technology resources, technicalfunctions, associated users, and the like), deficiency in data about theinformation technology operational activity (time, location,applications involved, persons/systems that initiated the activity andthe like), and the like. Incomplete data may refer to technologyelements without data entries, technology elements with partiallycompleted entries, deficiencies in specific terms/identifiers, and thelike. Inconsistent data may refer to conflicting entries in technologyelements, distinct technology elements without determined relationships,technology elements regarding discontinued/suspended technologyresources, obsolete data based on new activities, spelling/connotationerrors, and the like. The term “related” or “relationship” as usedherein is described below.

Typically, each technology resource of the multiple technology resourcesof the entity is related to other technology resource(s). For example, afirst technology resource comprising an application(s) may be installedon/or is required for the operation of a second technology resourcecomprising a server or processing device, such that functioning of theformer may affect the functioning of the later and vice versa. Asanother example, two or more technology resources may be related basedon the technical functions performed by the resources (based ontechnology resources with similar/same technical functions, technicalfunctions configured to be performed consecutively by the correspondingresources, processes that require the technology resources to performtechnical functions simultaneously or in parallel or in a specified timeinterval, functions of technology resources associated with similarusers/teams, and the like). As yet another example, technology resourceshaving shared technical resources/infrastructure (databases and othermemory locations, servers, processing devices, networks, applications,operating systems and the like) may be determined to be related sincechanges in the functioning of the shared resource may affect thefunctioning of the technology resources. These interdependencies betweenthe technology resources are referred to as the relationships betweentechnology resources. Likewise, types of technology elements in arecord, (technology resources, technical functions, associated users,locations and the like), may be related to one another. For instance,technical functions may be related to technology resources based on theability of the resources to support/carryout the functions, technologyresources may be related a location based on the physical location ofthe device, location of storage and the like, technical functions may berelated to personnel/users/systems authorized to perform the functions,and the like.

The system determines the relationships between the technology resourcesof an entity and relationships between various technology elements,based on analyzing the stimulus and effects in a plurality of historicalinformation technology operational activities retrieved from theactivity record database. In this regard, the system may determine dataquality rules comprising relationships between types of resources and/ortypes of technology elements. Here, “types” of resources or technologyelements, may refer to generic types, specific classes or predeterminedcategories of resources or technology elements. For example, the systemmay determine that a server/system hardware is typically related to anapplication and a business/technology process. As another example, thesystem may determine that a first type of technology element comprisinga technology resource is typically related to a second type oftechnology element comprising a location, a third type of technologyelement comprising an application, a fourth type of technology elementcomprising a technical function and a fifth type of technology elementcomprising a user performing the function. As such, the data qualityrules determined by the system may comprise globally applicable,exhaustive collection of possible relationships, and required formatsand content for corrected/modified data, that are dynamically updatedbased on current and/or historical information technology operationalactivities and other relevant data associated with the entity. Thesedata quality rules may be stored and dynamically updated in a dataquality database. In some embodiments, the data quality database is apart of the technology database 108.

The system may then identify a type of modified data required for the atleast one defective technology element based on retrieved data qualityrules from a data quality database, as illustrated by block 226. Asdiscussed previously, the system may determine the type of modified datarequired for the defective technology elements based on the existingtechnology elements, the appropriate retrieved data quality rules, datain the defective technology element (is any), and the like. For example,the system may identify a first type of technology element comprising atechnology resource of a specific server located at a predeterminedphysical location, in the first record. The system may then retrieve oneor more data quality rules that are directed to the first and/or secondtype of technology elements. Based on the data quality rules, the systemmay identify that one or more type of data elements are missing (forinstance, at least one technology application and at least onebusiness/technology process related to the server), or that the data inthe first and/or second type of technology elements is missing orinconsistent. The system may identify the type of modified data required(for instance, a first type of modified data directed to a technologyapplication and a second type of modified data directed to abusiness/technology process, or another type of modified data directedto the inconsistent data in the record).

Next, the system may retrieve one or more records of the plurality ofrecords regarding information technology operational activities from theactivity record database based at least on the type of modified data, atblock 228. Typically the retrieved one or more records comprise at leastone technology resource associated with the at least one technologyresource of the first information technology operational activity.Continuing with the previous example, the system may retrieve one ormore records of technology operational activities that involve thespecific server of the first record, activities that are associated withservers at the predetermined physical location, or activities that areassociated with servers in general. Although termed historical, it isunderstood that the retrieved activities may comprise informationtechnology operational activities that have already been completed,information technology operational activities that are currently inprocess, activities that are initiated/completed in real-time or nearreal time, and activities scheduled for a predetermined future time. Insome embodiments, the system may retrieve only those records that haveundergone the process 200B, and/or the records that are deemed to bedevoid of defective data.

Subsequently at block 230, the system may determine the modified datafor the at least one defective technology element, based on at least theretrieved one or more historical information technology operationalactivities and one or more retrieved inference rules from an inferencedatabase. The inference database may be a part of the technologydatabase 108. As an illustration, the system may identify one or morerecords of activities of incidents associated with the specific serverof the previous example, and comprising technology elements direct tothe required type of modified data (technology application and/orbusiness/technology process). Based on analyzing the records the systemmay determine that previous incidents of the specific server impacted afirst technology application. With the retrieved inference rules, thesystem may identify that the first technology application is typicallyassociated with a first business/technology process and a secondbusiness/technology process, and hence determine that the specificserver may be associated with the first and/or secondbusiness/technology processes. The system may further applycomplementary rules, in conjunction with historical records, forverifying the previous inferences, for identifying conflicting data(conflicts between the modified data and at least one historicalactivity record) and identifying obsolete/ceased relationships of thedata quality rules and/or inference rules. For example, based on a newrecord received in real time, the system may determine that the secondbusiness/technology process is no longer conducted at the predeterminedlocation of the specific server, therefore this relationship from theprevious inferences/inference rules is obsolete. Hence, the system mayidentify modified data for the first record comprising the firsttechnology application and the first business/technology process.Similarly, the system may identify the modified data required to correctany incomplete or inconsistent data in the existing technology elements,if necessary.

The system may then update, in real-time, the first record stored in theactivity record database with the modified data, at block 232. Updatingthe first record may comprise adding new technology elements withmodified data, replacing existing data with modified data, and the like.Updating the records may comprise dynamic and real-time or nearreal-time operations, performed at any stage of process flow 200A orsubsequent process flows to ensure that the data in the records isaccurate and current based on continually occurring informationtechnology operational activities. The system may also transmitalerts/notifications to the user about the updates in a manner similarto the alerts described previously.

Technical Language Processing

FIG. 3 illustrates a high level process flow 300 configured forsystematic technical language processing. Some or all of the stepsassociated with the process flow 300 may be performed by the system 106(the “system”), either alone or in combination with the technologyresources 150, technology database 108, user device 104 and otherdevices/systems, either separately of in conjunction with process flows200A and 200B. Typically, the system comprises an technical languageprocessor module 145, stored in at least one memory device 140,configured for (i) establishing technical and categorical context oftechnical data, (ii) transforming the technical language into formatteddata, and (ii) constructing categorical activity records associated withinformation technology operational activities. In some embodiments, thesystem comprises at least one processor 138 configured to executecomputer readable instructions associated with the technical languageprocessor module 145, for one or more steps of process flow 300.Executing the instructions in the technical language processor module145 (and/or other modules within the technology configuration system106) may cause the system to perform one or more steps described belowwith respect to process flow 300. As described previously, the recordsassociated with the information technology operational activities maycomprise descriptive data/unformatted data in the technology elementsidentifying the technology resources involved in the activity,personnel/users associated with the activity, timestamp, location, oneor more related records and/or operation shift/impact/problems reported.Analyzing the record that merely names/characterizes the aspects of theactivity, by conventional methods may not render the categorical contextof the technology elements readily apparent. The technical languageprocessor is a novel solution configured for deciphering technicallanguage/syntax, ascertaining the context of the activities andconstructing categorical records.

Initially, the system may retrieve a first record of the plurality orrecords from the activity record database, wherein the first recordcomprises a plurality of first technology elements associated with afirst information technology operational activity. Furthermore, thefirst information operational activity may be associated with at leastone first technology resource, as described previously. Typically, theat least one first technology resource is directed to the target offirst activity, or the first technology resource that is being actedupon. In some instances, with first records involving multiple firsttechnology resources, the system may identify the at least one firstresource that is the target of the first activity. For example, foractivity comprising software update for a specific software on aparticular device, the at least one first technology resource that isthe target of the activity may be the specified software and/or thedevice, while the related business/technology processes and relateddatabases may be mere auxiliary technology resources.

At block 302, the system may parse the first record to identify at leastone technology motivator, wherein the technology motivator is associatedwith initiating the first information technology operational activityregarding the at least one technology resource. Typically, thetechnology motivator is a user, system or device performing orinitiating the first technology activity on the at least one firsttechnology resource. For example, the technology motivator may be atechnology change requestor, a technology change implementer,maintenance operator, production support associate and the like. In someembodiments, with records involving multiple technologyresources/systems and/or users, the system may identify the technologymotivator based on identifying the user/the system that is authorizedto, is capable of, and is most likely to perform an activity on the atleast one first technology resource. In this regard, the system mayconsider historical activities, designation of the users/personnel, thetechnical specifications of the system and the first technologyresource, and the like. In some embodiments, where the technologymotivator is not present, the system may determine the required modifieddata based on historical information technology activities, data qualityrules, inference rules, and/or other relevant technology databases.

Next, the system may determine one or more technology actions that areassociated with the at least one technology resource and the at leastone technology motivator, at block 304. The one or more technologyactions refer to the acts or procedures of the first activity, that maybe performed by the technology motivator on the at least one firsttechnology resource. In some embodiments, the one or more technologyactions comprise an exhaustive list/finite number of possible actionsthat the technology motivator may perform on the technology resource.The system may identify the one or more technology actions based onhistorical activities performed by the technology motivator, and/oractivities that the technology motivator is authorized/configured toperform. Typically, each of the one or more technology actions isassociated with at least one action term (or example, updating,authentication, notification, correction, installation, and the like),by the system. The action terms may comprise variations of certainaction terms based on frequency of historical use, abbreviations,specific syntax/technical language associated with the technologymotivator, and the like.

Subsequently, at block 306, the system may determine at least onetechnology action of the one or more technology actions associated withthe first record. Here, the system may identify the specific at leastone technology action of the one or more possible actions that isperformed by the technology motivator with respect to the firstinformation technology operational activity. The system may make thisdetermination based on identifying at least one of the correspondingaction terms determined previously, in the first record.

Based on the preceding steps, the system may determine a categoricalcontext associated with the first information technology operationalactivity comprising at least the at least one technology resource, theat least one technology motivator, and the at least one technologyaction, at block 308. The categorical context may further identify thetype of activity (incident, change, event and the like), relationshipsbetween resources, and associated aspects. For example, the categoricalcontext of the records may comprise requesting an action, reporting anincident, performing a technology activity/action and the like, by thetechnology motivator on/with the technology resource. In someembodiments, determining the categorical context further comprisesmapping the first record to a plurality of technology identifiersretrieved from a categorical context database, based on technologylanguage context rules. Typically, the plurality of technologyidentifiers comprises the data fields of various categories required fora categorical record, the content of data fields required for acategorical record, format of the content, exhaustivekeywords/identifier lists associated with technology resources/aspectsof the activities of the entity classified into categories, and thelike. The categorical context database may further comprise a pluralityof technology language context rules that govern how the data in theexisting records should be mapped to categories of data fields, therebycreating a context for a record. For example, the technology languagerules may determine which word/phrase from the descriptive data of theexisting record is directed to a particular category of data field. Theconstruction, maintenance and dynamic testing of the technology languagecontext rules and the technology identifiers will be described later onwith respect to process flow 400.

In this regard, the system may first identify the required data fieldscomprising but not limited to the categorical context, the targettechnology resources, auxiliary resources, the technology motivator,type of activity, related records and type of relationship, timestamp,physical location and the like. Here, the existing first record maycomprise abbreviations, technical syntax specific to certaindevices/users, technical terms/nomenclature and other technical languagedata. The existing record may comprise data in the form ofsentences/phrases. The system may then extract the data specific to thefirst record that corresponds to each required data field, from thefirst record, for example, one or more words corresponding to a firsttarget resource, one or more words/phrases corresponding to one or morefirst applications and the like. For example, the first target resourcemay be specified in the first record in the form of a specific technicalnomenclature/language phrase. The system may identify that the specificnomenclature refers to the first target resource based on analyzing thesyntax of the technical languages associated with the technologyresources involved in the activity, at least a portion of the technicalnomenclature data, the determined context, interference rules and/orother relevant databases. Furthermore, the system may map the identifieddata with the technology identifiers from the categorical contextdatabase of the technology database 108. Here, the system may determinetechnology identifier data to be associated with each of the requireddata fields. For example, the system may determine that format of theidentifier data associated with a first application comprises a type ofapplication followed by first two letters of the name/maker of theapplication, followed by a version code and a unique alphanumeric code.As another example, the system may determine that a format for the firstphysical location comprises a unique alphanumeric code. As yet anotherexample, the system may determine that a particular type of firsttechnology action is associated with a symbolic code. The system maythen transform the existing descriptive data comprising words/phrasesand sentences to the required formatted data comprising technologyidentifier data in the appropriate data fields.

In some embodiments, determining the categorical context comprisesdetermining a perspective for the record based on the at least onetechnology resource, the at least one technology motivator, the at leastone technology action and/or the technology elements of the record. Forexample, the system may determine that although a specific record hasdata describing an incident/error, the specific record is has acategorical context of reporting the error or incident that had occurredpreviously. Similarly, as another example, the system may determine acategorical context of requesting a change/restoral action for aparticular record. As yet another example, the system may determine acategorical context of implementing/taking an action orperforming/initiating a change.

At block 310, the system may construct a new activity record or acategorical activity record associated with the first informationtechnology operational activity, wherein the new activity recordcomprises a plurality of data fields containing technology identifierdata (the plurality of technology identifiers) retrieved from thecategorical context database. In this regard, the system may construct anew record/object with the plurality of required data fields identifiedabove, each data field being associated with at least onecategory/aspect of the information technology operational activity. Thesystem may then transform the descriptive data of the existing firstrecord, to formatted, and searchable and retrievable data, based on thetechnology identifiers, and associate the resulting technical data withthe appropriate data field categories. The system may then store theformatted new activity record associated with the first informationtechnology operational activity in the activity record database. In someembodiments, each new activity record may comprise a data fieldcomprising a unique activity identifier or activity ID associated withthe information technology operational activity of the record. Theseactivity identifiers may be utilized to relate records. For example, fora first record associated with a first technology incident, the activityidentifier of a second record associated with a second technology changeactivity may be stored in a data field of the first record directed tothe causative activity category. Similarly, the second record may alsocomprise a data field of an impact category, with activity identifier ofthe first record. In this regard, the second technology change activitymay have been previously determined to have caused the first technologyincident, for example at Block 208. In some embodiments, the pluralityof records may comprise a linked list data structure, withnodes/pointers referencing related records. For example, the pluralityof records may comprise a singly linked structure or a multiply linkedlist structure. The system may initiate a display of the constructed newactivity record on the user device to receive user confirmation.

In some embodiments, the user may identify the categorical context ofthe first record and/or provide at least a portion of the contextualactivity record. The user may provide the information associated with atleast one technology asset, technology motivator and/or technologyaction. The system may then perform the steps 302-308 similarly todetermine the categorical context of the record. The system may confirmthe categorical context provided by the user based on comparing it withthe determined categorical context.

As such, the operational data processing of the plurality of records isdirected to determining interdependencies and relationships between theinformation technology operational activities, at process flow 200A. Theoperational data processing may further correct defective data andascertain missing data, at process flow 200B. The technical languageprocessor deciphers technical and descriptive data and determinescategorical contexts for the records. The technical language processorfurther constructs categorical activity records with a plurality of datafields comprising formatted technology identifier data, at process flow300. In this regard, the technical language processor may receivecorrected/transformed data from the operational data processor for theconstruction of categorical records. The technical language processormay also receive the determined relationship information from theoperational data processor, which may be transformed to data fields withformatted data during construction of the categorical records. Thecategorical records are typically complete and in a uniform format,which facilitates providing the records to the user or other systemsand/or for categorical data encoding described with respect to processflow 500, later on.

FIG. 4 illustrates a high level process flow 400 configured forsystematic data processing. Some or all of the steps associated with theprocess flow 400 may be performed by the system based on executingcomputer readable instructions associated with the technical languageprocessor module 145 (and/or other modules within the technologyconfiguration system 106). The technical language processor may befurther configured for storage, maintenance and retrieval of dataassociated with information technology operational activities, and theformatted categorical records constructed with respect to process flows200A and 300 in particular.

As alluded to previously, the technical language processor module isconfigured to transform descriptive data and unformatted data toformatted categorical records. This transformation may be accomplishedby utilizing technology language context rules and technologyidentifiers from the categorical context database of the technologydatabase 108. These technology language context rules and technologyidentifiers govern the interpretation of descriptive data, decipheringof technical languages and terminology, determining categorical contextand mapping of the determined categorical context of the existingrecords to technology identifiers/keywords to construct categoricalrecords. The technical language processor module may further comprise anadministration function that enables construction, maintenance andupdating of the technology language context rules and technologyidentifiers, systematic testing of rules, and dynamically assigning andreassigning technology identifiers to the rules based on testing, asdescribed by process flow 400. The present invention provides a novelmechanism of testing the technology language context rules, by utilizingthe rules to retrieve existing descriptive records. Based on analyzingthe retrieved records, the system may gauge whether the rules adequatelycapture the categorical context and correctly map the records totechnology identifiers. Typically, a technology language rule that maybe employed to transform an appropriate descriptive record based onmatching the context of the rule and the record, is deemed correctlyconstructed if it is able to retrieve at least the said descriptiverecord when applied to a plurality of descriptive records from theactivity record database.

The high level process flow may involve receiving a retrieval requestfor retrieving one or more records from an activity record database, atblock 402. This retrieval request may be received from a user, employeeor system associated with the entity, involved in constructing ortesting the technology language rules of the categorical contextdatabase. Typically, the retrieval request comprises one or moretechnology search terms directed to the records to be retrieved.

At block 404, the system may determine a first retrieval rule. Retrievalrule as used herein refers to a technology language rule being testedfor accuracy and efficacy based on the records retrieved by the rule ora new rule constructed based on the search terms. In some embodiments,the system may determine the first retrieval rule based on the one ormore technology search terms and technology language rules retrievedfrom the categorical context database, wherein the first retrieval ruleis configured for retrieving the one or more records associated with theretrieval request. In this regard, the system may determine a contextfor the retrieval request and choose the first retrieval rule having asimilar categorical context out of the plurality of technology languagerules in the categorical context database. For example, the technologysearch terms may be “production” and “server”. The system may thendetermine the first retrieval rule with the context of productionsupport for servers based on the technology search terms. Here, thesystem may either construct the first retrieval rule or retrieve atechnology language rule with a similar context. In other embodiments,where the technology language rules are being systematically tested, thesystem may choose the first retrieval rule of the plurality oftechnology language rules in the categorical context database based onany suitable criteria. Here the system may not require the retrievalrequest.

In some embodiments, determining the first retrieval rule furthercomprise determining technology identifiers comprising categoricalkeywords to be associated with the retrieval rule based on thedetermined context and other technology language rules. For example, thesystem may receive technology search term of “3DNS” and “data centerregion 1”. In this regard, the system may determine the categoricalcontext as load balancing (technology resource/technology action) fordata centers/servers in the geographical region of data center region 1.The system may then construct a first retrieval rule or choose aretrieval rule with similar context. Furthermore, the system maydetermine that 3DNS is a technology language terminology referring to aload balancer resource for a network of servers. The system may thenassociate categorical keywords of “3DNS”, “load balancer”, “controller”and “server” with the retrieval rule so that even the records that donot comprise the term “3DNS”, but refer to a generic term of loadbalancer/controller or variations thereof are retrieved. Furthermore,the system may determine categorical keywords comprisingnames/identifiers of the various data centers/server/networks in thedata center region 1, so that even records describing a specific serverwithin this geographic region are retrieved.

As another example, the technology search terms may comprise “network”and “alert”. In this regard, the system may determine a context ofalerts issued with respect to networks. In this regard, the system maydetermine one or more components of the network that may initiate,receive or be the target of one or more alerts. Hence, the system mayassign categorical keywords of “network”, “firewall”, “load balancer”,“proxy”, “router” and “circuit”. Therefore, a seemingly unrelated recordstating “A234C firewall notification issued”, is retrieved since thecontext of the retrieval rule is determined. This record may beoverlooked in absence of the categorical technical language processingof the present invention.

Furthermore, in some embodiments, determining one or more languageoperators for the retrieval rule. The language operators may compriselogical operators and Boolean operators like conjunction (AND),disjunction (OR), negation (NOT), equivalence, derived operators (XOR,XAND, and the like), or a suitable combination. In some embodiments, thelanguage operators may comprise proximity search operators that specifyallowable ranges of characters between two or more categorical keywordsor relative positions of the keywords in a record. The languageoperators may comprise wildcards, nested search strings or any othersuitable operators that aid in creating the retrieval rules as inclusiveor as narrow as required based on the context.

Next, at block 406, the system may retrieve the one or more firstrecords of the plurality of records from the activity record databasebased on the first retrieval rule. In this regard, the one or more firstrecords satisfy the first retrieval rule. The system may then analyzethe descriptive data in some or all of the retrieved one or morerecords, to determine a categorical context for each record. Thisdetermination of the categorical context may be similar to the stepsdescribed with respect to process flow 300. The system may determinethat one or more of the retrieved records are not associated with theretrieval request, where the determined categorical context of the oneor more records does not match the categorical context of the rule.Continuing with the previous example of the first retrieval rulecomprising the terms of “network” and “alert”. Although some records maycontain these terms or associated categorical keywords, the context ofthe records may not be relevant to alerts issued for a network.

In some embodiments, the system may initiate a presentation of theretrieved one or more records on a display/screen 112 associated withthe user device 104. The system may order the one or more first recordsbased on any suitable criteria. In some instances, a user (a technicalsubject matter expert, a technical associate of the entity, and thelike) may review the descriptive data of the retrieved records todetermine if the records relate to the retrieval request. Here, the usermay flag one or more of the retrieved records as being unrelated to theretrieval request or the user may confirm that the retrieval rule andthe mapped keywords are accurate. In some instances, the system maydisplay the one or more records not determined to be associated with therequest based on matching the categorical context described earlier. Inthis regard, the user may confirm that the one or more unrelated recordsare indeed not associated with the request and specify whether the firstretrieval rule needs to be modified. The user may also review thedescriptive data of the one or more records and specify that the one ormore unrelated records contain errors or data defects that caused themto be retrieved, and that the first retrieval rule is accurate.

At block 408, based on determining that the at least one of theretrieved one or more first records are not associated with theretrieval request, the system may (i) modify the technology languagerules retrieved from the categorical context database, (ii) modify thefirst retrieval rule and retrieve one or more second records of theplurality of records based on the modified retrieval rule, and/or (iii)determine a second retrieval rule based on the one or more technologysearch terms and retrieve one or more second records of the plurality ofrecords based on the second retrieval rule. Here, the system may analyzethe descriptive data of the one or more unrelated records that weredetermined to be distinct from the retrieval request, to identifywhether if it was the technology identifiers, the categorical keywordschosen, the language operators, or other factors that caused theunrelated records to be retrieved. In response to determining thaterrors in the technology identifier categories, keyword categories,defective mapping in the technology language rules, or the like causedthe unrelated records to be retrieved, the system may modify thetechnology language rules and/or the technology identifiers of thecategorical context database. In response to determining that theconstruction of the rule caused the unrelated records to be retrieved,the system may modify the first retrieval rule. For example, the systemmay modify the language operators, nesting of categorical keywords andthe like. In this regard, the system may update the first retrieval ruleand the mapping in the categorical context database and retrieve one ormore second records of the plurality of records based on the modifiedretrieval rule. The system may analyze the one or more second records ina similar manner, to determine if the modified rule is accurate. Inother instances, the system may discard the first retrieval rule andassociated mapped technological identifiers and categorical keywords andformulate a new second retrieval rule. This may be employed in instanceswhere the determined context of the technology search terms and/or thedetermined categorical context of the retrieval rule is determined to beinaccurate. The system may then retrieve one or more second records ofthe plurality of records based on the new second retrieval rule. Thesystem may further analyze the one or more second records in a similarmanner, to determine if the new second rule is accurate.

Categorical Data Encoding and Decoding

FIG. 5 illustrates a high level process flow 500 configured forcategorical data encoding. Some or all of the steps associated with theprocess flow 500 may be performed by the system 106, either alone or incombination with the technology resources 150, technology database 108,user device 104 and other devices/systems. Typically, the system 106comprises a categorical data encoding module 146, stored in at least onememory device 140, configured for systematic compression of dataassociated with information technology operational activities to reducestorage requirements. Executing the instructions in the categorical dataencoding module 146/data encoding module 146 (and/or other moduleswithin the technology configuration system 106) may cause the system toperform one or more steps described below with respect to process flow500.

Initially, the system may retrieve a plurality of records regarding aplurality of information technology operational activities from theactivity record database, at block 502. Typically, these plurality ofrecords are categorical records constructed by the technical languageprocessor of process flow 300. In this regard, each record of theplurality of records may comprise a plurality of data fields. These datafields comprise technology identifier data like technologyterms/categorical keywords/formatted data associated with the individualdata fields/categories of data fields regarding one or more aspects ofthe information technology operational activity. As discussedpreviously, entities are associated with hundreds of thousands ofinformational technology activities every month. Storing recordsassociated with these activities requires vast amounts of memory to beallocated for the express purpose of storing this data. In someinstances, the categorical encoding described herein drastically reducesthe memory requirements by compressing the data to a compression ratiosof about 100:1, 500:1, 1000:1 or greater, such that these plurality oftransactions may be stored with a few terabytes or megabytes of memorystorage. In some implementations, the system achieves a compressionratio of about 1000:1 or greater.

As discussed previously, each record of the plurality of records,comprises a plurality of data fields. For example, each record maycomprise 100, 200, 300, 500 data fields and the like. For each record,the system may analyze the data fields and the associated technologydata to determine one or more first data fields and one or more seconddata fields of the plurality of data fields, at block 504. In thisregard, in some embodiments, one or more records may comprise the firstdata fields, the second data fields or both. Typically, the first datafields are associated with particular category with a predeterminedfirst number of possible entries. For example, the first data field maybe associated with a data center category. Based on analyzing thecategorical context database and/or historical activity records, it isdetermined that the entity comprises 7 data centers in total, inseparate geographic locations, wherein 7 is the predetermined firstnumber. Hence, the data in this data field for any record will compriseone of the 7 possible data centers, or a combination of two or more datacenters of the available 7. As another example, the first data field maybe associated with a data field category describing whether the activityis an incident caused by change. Here, each record may contain one oftwo possible entries, yes or no. Therefore, the first data fields arecategories of data fields that have a finite predetermined number ofpossible entries, wherein the technology identifier data for any recordmust be associated with one or more the possible entries. In someembodiments, the finite predetermined number of possible entries islesser than or equal to a first data type threshold.

In addition, the records may be associated with second data fields,wherein (i) the second data fields may be associated with a secondnumber of possible entries that is greater than a predeterminedthreshold and/or (ii) the technology identifier data in the data fieldcomprises a specific type of content. For example, the second data fieldmay be associated with technology application category. Based on thecategorical context database, the system may identify that the entity isassociated with 6000 different technology applications in total. Thenumber of possible entries in this data field category for any record,6000 may be greater than a predetermined threshold. As another example,the second data field for a record associated with a technology incidentmay be associated with a category of the particular technology changeactivity that causing said technology incident. In this regard, the datafield may comprise the activity ID or a unique record identifierassociated with the specific technology change activity of theassociated record that is causing the technology incident of saidrecord. However, the unique identifier stored in this category for theplurality of records may be any of the numerous technology changeactivities associated with the entity. For practical purposes, in thisinstance, the second number of possible entries (thousands, millions,and the like) may be considered infinite.

In some instances, the second data fields may be determined to becategories of data fields that contain a specific type of content orpredetermined content type. The specific type of content may be definedby the maximum number of possible characters in the content of the datafield, number of characters required to represent the content in abinary, octal, hexadecimal or another suitable numeral system, type ofcharacters, symbols and the like. For example, a second data field maybe directed to a category that has entries of at most or exactly twocharacters, that may be represented by a predetermined number ofcharacters (zeroes and ones) when converted to binary representation.The purpose of determining the one or more first data fields and the oneor more second data fields of the plurality of data fields, will becomeapparent based on the following discussion.

In some embodiments, the records may comprise one or more first datafields, one or more second data fields and/or one or more third datafields. In some embodiments, the one or more third data fields (i) maycomprise data that is different from the first and/or second data fieldsand/or, (ii) may comprise data that is transformed differently from thefirst and/or second data fields, as will be described below. In someembodiments, the system may assign the third data field as a combinationof two or more separate data fields, based on determining that the datafields comprise related technology identifier data.

Next, at block 506, the system may transform, for each data field of theplurality of data fields, the technology identifier data into a binaryvalue. Although termed as a binary value, it is understood that thebinary value may comprise the binary, hexadecimal, octal, or anothersuitable positional/numeral system representation/encoding of thetechnology identifier data in the data fields. For the purposes ofillustration and not as a limitation, the various steps performed by thesystem will be described with respect to the binary value, being abinary representation of the technology identifier data comprisingzeroes and ones. Typically, the system transforms the keywords,terminology, identifiers and other technology identifier data in each ofthe plurality of data fields to binary values. In this regard, thesystem may transform the technology identifier data in all of theplurality of data fields uniformly, or the system may employ differenttransformation techniques based on the type of data fields. In thisregard, the system may transformation of the technology identifier databased on the type of data fields is described with respect to the firstdata fields and the second data fields. However, it is contemplated thatadditional types of transformations may be employed for other types ofdata fields.

For the each of the one or more first data fields of a particularrecord, determined to have a predetermined first number of possibleentries, the system may then determine the predetermined first number ofdata sub-fields. Continuing with the previous example of a first datafield of a data center category. The system may determine that theentity comprises the predetermined number 7 data centers, which areidentified by their geographic location. The system may then determine 7data center geographic locations (Location 1, Location 2, Location 3,Location 4, Location 5, Location 6 and Location 7) and construct a datasub-field for each of the 7 possible data centers. For a record, withthe data center data field having the data regarding Location 5, thesystem may assign zeroes (0) to all the sub-fields except the sub-fieldthat relates to the Location 5, where the system may assign a value ofone (1). As another example, another record may comprise a data fieldlisting two data centers at Location 1 and Location 6. Here, the systemmay assign zeroes (0) to all the sub fields except those pertaining toLocation 1 and Location 6, which may be assigned one (1). Therefore adata field comprising textual data reading “Location 1 and Location 6”may be transformed to a mere 7 characters of “1000010”, each characterreferring to a data sub-field. Therefore, the system determines, foreach first data field of the plurality of data fields, the predeterminedfirst number of data sub-fields and assigns a binary value to each datasub-field based on the technology identifier data associated with thefirst data field.

For each of the one or more second data fields of a particular record,the system may convert the technology identifier data associated withthe second data field into a binary value. As an illustration,continuing with the example of a second data field associated withtechnology application category. Based on the context mapping of theprocess flow 300, these second data fields may contain the uniqueidentifiers or alpha numeric codes for the one or more applicationsassociated with the record. In this instance, the system may convert thetechnology identifier data comprising unique identifiers into a binaryvalue.

In some embodiments, the records may comprise one or more third datafields that may be different from the first and/or second data fields,or may comprise a combination of two or more related data fields. Insome embodiments, the data in the third data fields may be encoded intwo or more sections/parts, based on identifying different aspects ofthe data. For example, a third data field may be related to defects ofprogram products, which are either reported by the record or have causedthe incident pertaining to the record. Here, the system may analyze thedata in the third data field and determine that the technologyidentifier data in the field comprises a first part referring to aparticular program product and a second part referring to adefect/failure mode of the particular program product. It is noted that,in some embodiments, the first part data and the second part data mayrefer to separate data fields that are determined to be related, and areencoded in relation to one another. In this regard, the system maytransform the first part data and the second part data differently basedon identifying that each program product or a plurality of programproducts of an entity is associated with/related to a certain number oferror/failure modes. Here, the system may transform the first part datainto binary values by converting the data into a plurality of datasub-fields pertaining to a finite number of program products, orconverting the technology identifier data pertaining to the programproducts (for example, one or more unique alpha numeric charactersidentifying each program product) into binary values directly, asdescribed previously. The system may then similarly transform secondpart data regarding the error/failure modes by converting uniqueidentifier data into binary, transforming the second part into aplurality of data sub-fields, or using any suitable transformationdescribed above. Therefore, a portion of the resulting binary values forthe third data field may refer to the first part data while theremaining second portion may refer to the second part data.

The cascading nature of encoding, employed for the third data fieldsprovides significant reduction in the number of binary values that arerequired to represent the technology identifier data, and hence providesa further reduction in memory requirements. This reduction in size iselucidated using the previous example of the first part data beingdirected to a program product resource and the second part data beingdirected to failure modes. As such, the entity may be associated withnumerous failure modes, for example 1000 unique failure modes.Representing the 1000 unique failure modes, without determining therelationship with the program product may require at least 10 binarydigits. However, as a result of the cascading form of encoding the thirddata fields, the system may determine that each program product isrelated to at most 7 unique failure modes. Therefore, by correlating thefirst part data with the second part data during the encoding process,the system would only require at most 3 binary digits to represent the 7possible failure modes for a given program product encoded in the firstpart data. On the whole, the system is able to represent 1000 uniquefailure modes using just 3 binary digits.

Next at block 508, the system may encode using a categorical dataencoding algorithm, for each record of the plurality of records, thebinary values associated with the plurality of data fields into anencoded word comprising a predetermined number of characters. Here, thecategorical data encoding algorithm may receive the binary values in theplurality of fields in a particular record, and transform and/orcompress these values into an encoded word. As a non-limiting example,in one instance, the technology identifier data of a plurality of datafields (for example, 300 in number) in a record may be converted tobinary values. Now after the first transformation, the record maycontain about 9000, 16000 or 20000 or similar ranges of number ofcharacters of binary values representing the textual data in theplurality of data fields. Using the categorical data encoding algorithm,the system may transform the binary values into an encoded wordcomprising predetermined number of characters (5, 6, 8 characters andthe like) that contains/represents all the technology identifier data inthe plurality of data fields of a record. In this regard, the system mayachieve compression ratios of about 1000:1 or higher, with respect tothe reduction in sizes/memory requirements from the technologyidentifier data in the categorical record to the encoded wordsrepresenting the record. In some embodiments, the lengths/number ofcharacters of encoded words of one or more records may be extended whendesired. The categorical data encoding algorithm may employ binary codeddecimal, hexadecimal or any other suitable method of encoding based onthe type of binary values (binary, hexadecimal, octal and the like) andthe compression ratio desired. In some embodiments, the categorical dataencoding algorithm may employ suitable lossless compression techniquesto transform the binary values (for example, Lempel-Ziv-Markov chainalgorithm, and the like). In some embodiments, the categorical dataencoding algorithm may comprise multiple stages of data transformation.The encoded word may comprise numerical, alphabetic, symbolic or anyother suitable combination of characters. The new record after thetransformation, comprising the encoded word(s) is referred to as theencoded record.

Although, termed as “an encoded word,” in some embodiments, the encodedword or a record may refer to one or more encoded words. In this regard,each of the one or more encoded words may comprise a predeterminednumber of characters, and may correspond to one or more data fields ofthe plurality of data fields of the categorical record. In someembodiments, the system may correlate the plurality of data fields intoone or more categorical groups, based on at least the categoricalcontext determined using the technical language processing describedpreviously, and determine at least one encoded word for each categoricalgroup. For example, the system may determine that a portion of the datafields are directed to a first categorical group of “impacted resources”(comprising one or more data fields pertaining to impacted technologyapplications, impacted data centers, impacted technology/businessprocesses, and the like) based on analyzing the categorical context ofthe record. The system may then construct one encoded word for thebinary values pertaining to the data fields in this categorical group.As further examples, the system may identify a categorical group ofresource technology (comprising one or more data fields pertaining totechnology applications of the incident/change, servers/hardwaretechnology types, and the like), a categorical group of recordactivity/action type (comprising one or more data fields identifyingwhether the record refers to an incident/change performed, an errorreported, a technology change requested, fields comprising a uniquerecord identifier and the like), a categorical group of technologyactivity parameters (comprising one or more data field with impactfactors/impacts associated with the technology change activity of therecord, determined exposure index of the activity of the record, andother parameters), and the like. Here the system may determine anencoded word for binary values of each categorical group, such that theencoded record may comprise one or more encoded words.

Next, at block 510, the system may then store an encoded record, foreach record of the plurality of records, in the activity recorddatabase, wherein the encoded record comprises the encoded word(s)corresponding to the plurality of data fields associated with the recordregarding the information technology operational activity. This encodedword(s) may represent the plurality of data fields and the respectivetechnology identifier data. Therefore, instead of storing all of thetextual data in the plurality of data fields, the system may store thefew predetermined number of characters of the encoded word(s) torepresent the record, thereby drastically reducing memory requirements.The system may discard the original plurality of records regarding theplurality of information technology operational activities from theactivity record database, and store only the new encoded records.Encoded words of only the desired records may be decoded to provide theinitial records with the plurality of data fields and the respectivetechnology identifier data, as will be described below by high levelprocess flow 600 of FIG. 6.

FIG. 6 illustrates a high level process flow 600 configured for dynamiccategorical data decoding. Some or all of the steps associated with theprocess flow 600 may be performed by the system 106, either alone or incombination with the technology resources 150, technology database 108,user device 104 and other devices/systems. Typically, the system 106comprises a dynamic data decoding module/categorical data decodingmodule 147, stored in at least one memory device 140, configured fordynamic decoding of data associated with information technologyoperational activities to reduce storage requirements. Typically, thedynamic data decoding module is in operative communication with thecategorical data encoding module 146, such that any changes to theencoding algorithm are reflected in the decoding algorithm, inreal-time. Executing the instructions in the dynamic data decodingmodule 147 (and/or other modules within the technology configurationsystem 106) may cause the system to perform one or more steps describedbelow with respect to process flow 600.

Initially, the system may receive a retrieval request for retrieving oneor more records from an activity record database from a user device, atblock 602. As used herein, the plurality of encoded records stored inthe activity records database comprise the encoded records constructedusing the categorical data encoding module of process flow 500,described previously. Here, each encoded record of the plurality ofencoded records comprises an encoded word(s) associated with atechnology operational activity, representing the technology identifierdata of the record. Typically, the retrieval request comprises one ormore technology criteria terms, directed to the one or more encodedrecords of technology operational activities that are desired to beretrieved. In this regard, the technology criteria terms may comprisetechnology keywords regarding technology resources, technologymotivators, technology actions and the like, terms associated with thetime frame of the desired records, logical operators and other languageoperators, types of information technology operational activities andtheir relationships, and other aspects of the activities. For example,for a retrieval request seeking to retrieve technology incidentsassociated with a first technology resource application in the past 6months, a first criteria term may be directed to the first technologyresource application, a second criteria term may be directed toincident/activity type and one or more third criteria terms directed tothe 6-month time period.

Next at block 604, the system may determine a numeric value for eachterm of the one or more technology criteria terms. In some embodiments,the system may determine the one or more data fields that the criteriaterms are directed to. For example, for a criteria term associated witha first server, the system may determine that the criteria term isdirected to data field categorical groups of technology resources actedupon or technology resources impacted/affected. Furthermore, the systemmay determine a numeric value for each technology criteria term based onthe content of the criteria term, the data field category that thecriteria term is directed to, and other factors. In some embodiments,the system may determine the numeric value based on retrieving data fromthe categorical data encoding module and the categorical contextdatabase. In this regard, the categorical context database may store anexhaustive list of numeric values determined for each technologycriteria term. As such, the numeric values may be assigned uniquely foreach technology criteria term, or may be assigned uniquely within setsof technology criteria terms pertaining to the one or more categoricalgroups or the one or more data fields. In some embodiments, the numericvalues are assigned based on bitwise logic, such that each numericalvalue for a criteria term is selected from a group comprising powers of2 (1, 2, 4, 8, 16, 32 . . . and so on), for reasons that will becomeapparent in the subsequent steps. In embodiments where the technologycriteria term may refer to multiple aspects of the record, the numericalvalue for the criteria term may be a combination of numeric valuesassigned to each aspect.

Subsequently at block 606, the system may determine a decoding divisorfor the retrieval request. Typically, the decoding divisor is a resultof a combination of the one or more numeric values associated with theone or more technology criteria terms, determined previously. In someembodiments, the decoding divisor is determined based on addition of thenumeric values either alone or with suitable weights. In someembodiments, the decoding divisor is determined based on a suitablealgebraic combination of the determined numeric values based on the typeof technology criteria terms, the language operators in the retrievalrequest, the type/category of data field corresponding to the technologycriteria term, and the like. The resulting decoding divisor is typicallyconfigured such that, only the encoded words of the one or more recordsof the plurality of records that correspond to the technology criteriaterms of the retrieval request are exactly divisible by the decodingdivisor. The decoding divisor is configured to be commonly applicable tothe encoded words of one or more encoded records of the plurality ofencoded records that correspond to the one or more technology criteriaterms of a particular retrieval request. In the embodiments, where thetechnology criteria terms are assigned numeric values of powers of 2,the decoding divisor may be determined by the addition of the associatednumeric values. Typically, the decoding divisor is dynamicallydetermined for the specific retrieval request and the associatedcriteria terms, such that different retrieval requests may havedifferent decoding divisors.

In some embodiments the system may construct multiple decoding divisorsor sub-divisors for each request, by combining groups of numeric valuespertaining to like criteria terms. For example, the system may determinethat a first portion of the technology criteria terms refer to an impactcategorical group, while a second portion of criteria terms refer to aresource technology group. In this regard, the system may generate afirst decoding divisor configured to act on the encoded word related tothe impact categorical group and a second decoding divisor configured toact on the encoded word related to the resource technology categoricalgroup. As such, the system may determine the number and groups ofrequired decoding divisors based on the number and groups of encodedwords in a record.

The system may then retrieve the one or more encoded records of theplurality of records based on the decoding divisor(s), at block 608.Here, the encoded words associated with the one or more encoded recordsare divisible by the decoding divisor, facilitating in the reduction inthe required processing speed and technology resources. In theembodiments with multiple divisors or sub-divisors, the system maydivide/operate upon the encoded words of categorical groups withcorresponding divisors pertaining to the groups. Here, a record may bedetermined to be pertinent if the each of the multiple divisors are ableto completely divide the corresponding encoded words of a record.Conventional systems require the text in the technology criteria termsto be compared to the descriptive/textual data in each of the pluralityof records, to determine relevance. Comparison of indices, strings,phrases and words requires each criteria term to be compared to all thetextual data in the records. The present invention provides animprovement to data retrieval and processing, since the pertinence ofeach of the plurality of records may be determined by merely performinga division of the encoded word and the decoding divisor, withoutrequiring data comparison of textual data. For example, the system mayperform a division operation of the encoded word or a numericalrepresentation of the encoded word with the decoding divisor. Therecords that yield a remainder of zero may be determined to be thepertinent one or more records.

In some embodiments, the division operation described above may beperformed by deconstructing the encoded words into representative powersof 2. For example, the system may identify a first set of divisor valuesfor a particular divisor comprising the numerical values of theassociated criteria terms (for example, 2, 32, 64, and 1024, with eachpower of 2 representing one technology criteria term). The system maythen determine a second set of encoded values for each of the pertinentencoded words of the plurality of records, the second set of encodedvalues comprising powers of 2, that when added result in the particularencoded word. As an example to illustrate the division operation, theencoded word or a numeric representation of the encoded word may be“1138”, that may be associated with a second set of values, comprisingvalues of 2, 16, 64, 32 and 1024, that are powers of two that when addedresult in 1138. The system may determine pertinent records based ondetermining that every value in the first set of divisor values ispresent in the second set of encoded values. Continuing with theprevious example, the record with the encoded word 1138 may bedetermined to be pertinent, and another record with the encoded word0114 may be flagged as being unrelated to the search request for thefirst set of divisor values of 2, 32, 64, and 1024. As such, in someembodiments, the system may determine multiple second sets of encodedvalues for each record to represent the various combinations of powersof 2. For example, the encoded word 1138 may be pertinent for a divisorcomprising a first set of divisor values of 8 and 64, since 1138 maycomprise another second set of encoded values of 2, 8, 8, 32, 64 and1024. Typically, the encoding using the encoding algorithm of processflow 500 is configured such that this division is feasible.

Therefore, the present invention provides improved data storage andretrieval processes, with lower processing time and reduced memoryrequirements. In some embodiments, retrieving the one or more recordsfurther comprises dynamically creating the data retrieval technologylanguage, associated syntax, and controls for the determination ofpertinent records and/or retrieval of pertinent records in temporarymemory, based on at least the decoding divisor, without the need forpre-existing technology language. Here, the steps of determining thenumeric values/decoding divisions and determination of pertinent recordsmay be computed and executed using temporary memory locations, with lessmemory requirements and quicker processing. The present inventionprecludes the need for iterative algorithms, and other query processing,data matching and indexing algorithms to be stored in the memory.

The system may then decode, using a categorical data decoding algorithm,each of the one or more encoded records that were determined to berelevant to the retrieval request, into one or more decoded records, atblock 610. Unlike conventional systems, the present invention comprisesthe ability to decode only the pertinent records without requiring allrecords to be decoded to determine relevance. In some embodiments, thecategorical data decoding algorithm transforms the encoded word intodecoded records comprising binary values associated with the informationtechnology operational activity. In some embodiments, these binaryvalues may be similar to those of block 506 of process flow 500.Decoding using the categorical data decoding algorithm may furthercomprise transforming, for each decoded record of the one or moredecoded records, the binary value associated with at least one datafield of the plurality of data fields into technology identifier data.In this regard, the decoding algorithm may utilize transformation systemthat was utilized to encode the records, for example the binary codeddecimal system. Here, the system may then reconstruct the textual dataand technology keywords associated with each of the plurality of datafields based on the binary values in the data field. For example, for afirst data field in the data center category comprising binary value of“0110010”, the system may analyze binary value associated with eachsub-field, and determine technology identifier data of “Location 2,Location 3 and Location 6”. As another example, for a second data field,the system may convert the binary value into associated technologyidentifiers/keywords.

FIG. 7A illustrates a high level process flow 700A configured fordynamic categorical data decoding and creation of contextual visualdisplays associated with information technology operational activities.Some or all of the steps associated with the process flow 700A may beperformed by the system 106, either alone or in combination with thetechnology resources 150, technology database 108, user device 104 andother devices/systems. Typically, the system 106 comprises a dynamicdata decoding module/categorical data decoding module 147, stored in atleast one memory device 140, configured for systematic compression ofdata associated with information technology operational activities toreduce storage requirements. Executing the instructions in the dynamicdata decoding module 147 (and/or other modules within the technologyconfiguration system 106) may cause the system to perform one or moresteps described below with respect to process flow 700A. In someembodiments, the system transmits control instructions that cause theuser device 104 to present visual displays of retrieved records on thedisplay device 112, via an established communication channel.

Initially, the system may receive a retrieval request for retrieving oneor more records from an activity record database from a user device, atblock 702. Typically, the retrieval request comprises one or moretechnology criteria terms, directed to the one or more encoded recordsof technology operational activities that are desired to be retrieved.

Next at block 704, the system may determine a numeric value for eachterm of the one or more technology criteria terms. Subsequently, thesystem may determine a decoding divisor for the retrieval request.Typically, the decoding divisor is derived from a combination of the oneor more numeric values associated with the one or more technologycriteria terms, determined previously. The system may then retrieve theone or more encoded records of the plurality of records based on thedecoding divisor. The steps 702 and 704 may be substantially similar tothe steps described with respect to process flow 600.

Using the determined decoding divisor, the system may determine countsof technology identifier data associated with the one or more pertinentrecords, at block 706. The system may determine a total count numbercomprising the number of one or more records of the plurality of recordsthat are pertinent to the technology criteria terms of the retrievalrequest. For example, the technology criteria terms provided by the userin the context of analyzing incidents reported for applications in aparticular time period, may be “technology applications”, “incident”,“from date” and “to date”. In this regard, in some embodiments, thesystem may determine a categorical context for the retrieval request,similar to process flow 400 and block 404 in particular. The system maygenerate a unique first decoding divisor for these criteria terms.Dividing each encoded word of the plurality of encoded records resultsin one or more first encoded records whose encoded words are exactlydivisible by the first decoding divisor. The number of these one or moreencoded records is the total count number representing the total numberof technology incidents (of the plurality of information technologyoperational activities) that are related to technology applicationresources in the particular time period. In this regard, the data fieldcategory of target technology resource of the one or more pertinentrecords may comprise technology identifier data pertaining to one ormore technology applications of the entity, the data field categoryactivity ID/Activity Type/Technology action may comprise technologyidentifier data that may help in construing the record to pertain to atechnology incident, and the data field category of activitydate/timestamp of the one or more pertinent records may compriseactivity dates occurring in the predetermined time period. In someembodiments, the total counts are absolute values, while in otherembodiments, the total counts may be converted to percentages/fractionsof the number of the plurality of activities/records.

However, since entities often have a large number of technologyincidents (for example, hundreds of thousands), merely providing a totalcount is not helpful in analyzing the technology incidents to determineexposure and to predict future incidents in some instances. Furthermore,retrieving, decoding and reviewing the large number of technologyincidents either by the system or the user, while consuming enormousamounts of memory and processing power, is typically not feasible forinterpretation of the aspects of the incidents in a comprehensive andtimely manner to implement and modify future technology changeincidents. The present invention provides a solution to the above bydetermining categorical counts to aid in interpretation of thetechnology incidents, evaluating the likelihood that technology changeswill cause incidents, determining the impact of technology changeincidents, and modifying the implementation of technology changeactivities/events.

In some embodiments, the system may additionally generate categoricalcounts associated with the retrieval request. In some embodiments, thesystem may determine a categorical context for the retrieval request,similar to process flow 400. Based on the determined categoricalcontext, or based on received user input, the system may determine oneor more auxiliary categories of data fields that are pertinent to theretrieval request and its categorical context. Typically, the auxiliarycategories of data fields are configured to help the user/the systembetter understand, trend and interpret the relevant one or more records,without requiring decoding of the records.

Continuing with the previous example, based on the determinedcategorical context of incidents reported for applications in aparticular time period, the system may determine that a first auxiliarycategory of “type of technology action/incident issue reported” may helpin further analyzing the activity data. Consequently, the system maydetermine the possible types of technology incident issues associatedwith applications based on historical activities, based on retrievedinformation from the categorical context database, based on technologyidentifier data, based on content in the data fields identified by atleast partially decoding the one or more encoded records, based on thecategorical context and/or based on the user input. For instance, thesystem may determine that of a multitude of technology incident issuesassociated with technology applications, 6 incident issues are mostfrequently reported, namely, incident issue 1, incident issue 2,incident issue 3 and so on. The system may then generate unique firstauxiliary divisors for each of the 6 incident issues' associatedkeywords/technology identifier data, for example first auxiliarydecoding divisor 1, first auxiliary decoding divisor 2, first auxiliarydecoding divisor 3, and so on respectively. The system may use the firstauxiliary decoding divisor 1, to determine a categorical count 1 ofencoded records of the one or more records, reporting the incident issue1. Similarly the system may determine respective categorical counts oftechnology incidents for each of the various incident issues. In someembodiments, the categorical counts are absolute values, while in otherembodiments, the categorical counts may be converted topercentages/fractions of the total count of the one or more pertinentincidents/records. This helps the system determine which incident issueshave occurred the most in the predetermined time period, trend theresults and/or construct contextual visual displays. In someembodiments, the system may convert the determined categorical counts torelative values comprising percentages/fractions of the total countand/or the plurality or records.

Similarly, the system may determine a second auxiliary category ofincident causes/technology change activities that caused the incidents.The system may determine the categorical counts of the type oftechnology change incidents/technology actions of change activities thatcaused the various incidents. The system may then review this aggregatedata, and correlate the previously determine incident issues with thecausing technology change incidents, to determine exposure, to ascertainthe likelihood of change incidents and the like. Similarly, the systemmay determine a third auxiliary category of organizations within theentity, where the one or more incidents occur. The system may determinethe categorical counts of the portions of the one or more incidentsoccurring at the known 7 organizations of the entity. In someembodiments, the auxiliary categories and the categorical counts aredetermined based on determining the data points required for the visualelements of the contextual visual displays requested by the user. Forexample, categorical counts of number of incidents of each week inspecified time period are determined to be required for a line-graphcontextual visual element, or categorical counts of number of incidentswith impact factors/impacts in a predetermined ranges/thresholds aredetermined to be required for a pie-chart graphical element.

In some instances, the system may determine the unique decoding divisorfor combinations of auxiliary categories. For example, the system maydetermine categorical counts for technology incidents of the one or morepertinent records that were caused by technology changes that thatoccurred within a particular week 2 in the specified time period. Visualrepresentations 700B of the above examples are described with respect toFIG. 7B, below.

Based on the determined total counts and the categorical counts, thesystem may then generate one or more technology interfaces/displays forpresentation on the user device 104, at block 708. These technologyinterfaces may comprise contextual visual elements, graphicalmanipulation tools and control elements, user input interfaces, and thelike. In some embodiments, the system may provide a user technologyapplication 122, stored on the user device that is configured to presentthe one or more displays on the display device 112, based on receivingcontrol instructions from the system. In some embodiments, the usertechnology application 122 may be constantly running in the background,wherein control instructions from the system cause the application toturn the user device on and automatically present the technologyinterfaces to the user. In some embodiments, presenting the one or moretechnology interfaces on the user device 104 comprises, resizing andrepositioning one or more existing windows on the user display device112. In some embodiments, the one or more technology interfaces aredynamic and the contextual visual elements are modified in real-time ornear real time based on current activity data. The contextual visualelements may comprise pie charts, bar graphs, line graphs, functionplots, histograms, infographics, timelines, maps, charts, tables, andother suitable forms of graphical representation of activity data. Insome embodiments, the contextual visual elements are actionable, and oneor more predetermined physical gestures from the user (scroll, touch,click, and the like) may cause modification of the visual elements,activation of links embedded in the visual elements, causing opening ofpop-up windows and the like. The graphical manipulation tools, controlelements and user input interfaces may comprise checklists, tables, dropdown lists, list boxes, pop-up menus, widgets, radio buttons, toggleswitches, toolbars, text boxes and the like to enable user selection ofparameters, navigation through the interface, user input of one or moreparameters, and display of confirmation or output.

The generated technology interfaces will be described in detail withrespect to a user interface display/visual representations 700Billustrated in FIG. 7B. The user interface display 700B, is provided asan example and not as a limitation of the one or more technologyinterfaces generated by the system. It is understood that multipleembodiments of the technology interfaces may be contemplated based onthe features discussed in this disclosure. In some embodiments, thedisplay comprises user input tools configured to receive user input inthe form of selection of one or more presented options, input in theform of textual, audiovisual commands or other forms of data provided bythe user, and the like. FIG. 7B illustrates user input tools comprising,but not limited to, date range 709, target level 710, region 712,technology issue/technology action reported 714, technology incidentcause 715, restoral action 716, refine search 718, format 720, and othercategories of data fields. In some embodiments, these user input toolsmay be used to provide the technology criteria terms of 702, for examplethe desired time period using date range 709, desired types ofincidents/issues using block 714, desired corrective measures/activities716, and the like. In some embodiments, the user input tools may beutilized to modify, choose or create contextual visual elements. Forexample, target level 710, enables the user to provide the desired levelof abstraction, for example entity level, region level, organizationlevel, data center level and the like. As another example, format 720may be used to filter common causes and operational noise and displayhigh exposure event counts based the user's choice of an exposure index.Format 720 may also be used to construct the contextual visual elementsbased on relative impact factors instead of incident counts.

In some embodiments, the system may comprise contextual visual elements730, 740 and 750. Contextual visual element type 1 at 730 may comprisepie charts illustrating relative categorical counts of the pertinent oneor more incidents, based on auxiliary categories of issues reported 732,incident causes 734, organizations 736 and regions 738. For example,contextual visual element 732 of category of incident issuesreported/technology actions reported may be a pie chart with one or moresector, each sector representing the relative percentage/categoricalcount of a particular type of incident issue/technology action. Eachsector may be represented with a different color, texture and the like.Contextual visual element type 2 at 740 illustrates a temporal incidenttrend for the particular time period. In this regard, the system mayplot the weekly variation of technology incident counts, with the data744 on one axis and the number of incidents 742 on another. The systemmay plot the total counts of one or more incidents occurring from weekto week at 746. The system may further plot the categorical counts of acombination of auxiliary categories illustrating the counts of incidentsthat were caused by change at 748. The system may further provide acontextual visual element 750 providing an incident view. In thisregard, the system may display the types of technology resources liketechnology applications, and their associated incident counts in thetime period. These may be ordered in any suitable fashion, although FIG.7B illustrates the technology resources as being ordered based on adescending order of incident counts.

In some embodiments, the system may display an activity record view 760of decoded records comprising a plurality of data fields and theassociated technology identifier data. The system may decode at least aportion of the one or more records for display in 760, based on userinput, based on determining highest exposure technology changeactivities, based on user selection of one or more sectors of visualelements 730, and the like. For each, record of the activity record view760, the system may present action buttons 761, to enable the user toexclude one or more records from consideration, flag one or moreunrelated records similar to block 406, choose one or more records foradditional details and the like. Each record, may comprise a pluralityof data field categories like activity ID 762, activity date 763, targettechnology resource 764, technology action 765, location 766, impact767, if the activity is an incident that was caused by a technologychange activity 768, the incident type 769 or the type of incidentcaused by the activity 762, and entity organization 770. It isunderstood that the activity records may comprise more or fewer datafields. For example, in one instance, activity records may comprise 300or 400 data fields, each data field comprising appropriate technologyidentifier data.

FIG. 8 illustrates a high level process flow 800 configured forevaluating technology stability. Some or all of the steps associatedwith the process flow 800 may be performed by the system 106, eitheralone or in combination with the technology resources 150, technologydatabase 108, user device 104 and other devices/systems. Typically, thesystem 106 comprises a module (comprising one or more of the modules144-148), stored in at least one memory device 140, configured fordetermining operational impact of technology incidents. Executing theinstructions in the module may cause the system to perform one or moresteps described below with respect to process flow 800.

As discussed previously, an entity may be associated with numerousinformation technology operational activities. These informationaltechnology operational activities may comprise technology changescomprising activities performing technology changes on/to one or moretechnology resources. Information technology operational activities mayalso comprise a plurality of technology incidents. In some embodiments,at least a portion of the technology incidents are caused by technologychange activities. This relationship may be provided by the user, may bedetermined by operational data processing of process flow 200A, and/ortext mining of activity records.

At block 802, the system may retrieve a plurality of records regarding aplurality of technology incidents from an activity record database,wherein each record of the plurality of records is associated with aplurality of data fields comprising technology identifier dataassociated with a technology incident. These records may be thecategorical records constructed by the technical language procession ofprocess flow 300. Although termed as technology incidents, in someembodiments, the technology incidents may be technology changeactivities, and/or the process flow 800 may be utilized to evaluate thestability of technology change activities.

Next at block 804, the system may determine, for each technologyincident of the plurality of technology incidents, an operational impactcaused by the incident, based on at least analyzing a portion of theplurality of data fields. The operational impact or impact of atechnology incident may comprise expenses, outlays and other losses tothe entity due to the technology incident. The operational impact may bethe measure of magnitude of costs due to the occurrence of thetechnology incident or expected or potential costs for incidence of thetechnology incident at a predetermined future date. Typically, theoperational impact comprises financial cost value of the technologyincident, reputational impact of the technology incident, failedcustomer interactions during the technology incident, down time causedby the technology incident, associate hours required for restoralactions and/or other expenses or costs to the entity. In someembodiments, the operational impact is the financial impact of thetechnology incident. In this regard, the system may convert the othercosts into respective financial impact values and aggregate them byaddition or by a suitable combination using weights. For example, failedcustomer interactions may result in a loss in revenue comprising afinancial impact value. The operational impact may be provided by theuser and/or may be determined by the system.

In this regard, the system may analyze one or more data fields of atechnology incident record, to determine type of incident, duration ofincident, impacted/target resource types and other aspects of thetechnology change incident. Based on this analysis the system maydetermine an incident priority for the technology incident. Typically,the technology incidents of the entity may be associated with anincident priority or priority rating. The priority rating may be ameasure of the magnitude of the impact of the incident, importance ofthe technology resources being affected, criticality of error messagesproduced and/or other pertinent factors. In this way, priority ratingsmay be assigned, with first priority incidents being most criticaland/or having the largest impact (above a predetermined threshold),second priority incident having lesser impact (within a second range),third priority incidents having further lesser impact and so on. Thefirst, second, third and other priority ratings may be different fordifferent types of incidents in some embodiments, while in otherembodiments, the priority ratings are globally applicable. Typically,each priority rating is associated with an operational impact. Thisoperational impact may be determined by trending impacts of likehistorical incidents over a predetermined time period, for example ayear. In some embodiments, the operational impact or the impact factordescribed herein may be similar to the impact described with respect toprocess flow 1000, and block 1006 in particular.

The system may then retrieve, one or more historical technologyincidents from the activity record database, whose incident priorityratings are the same as that of the technology incident. For example,for a technology incident determined to have a first priority rating,the system may retrieve one or more historical technology incidentshaving a first priority rating and/or the same type of technologyincident. The system may then determine the operational impact for thetechnology incident based on at least the historical operational impactsof the one or more historical technology activities. Here the system mayaggregate, determine an average, combine based on weights, or suitablytrend the historical operational impacts.

In the instances where the process flow 800 is utilized to determine thestability of technology change activities, the operational impact of thetechnology change activity may comprise a combination of operationalimpacts of one or more technology incident activities caused by thetechnology change activity, determined in a similar manner as describedabove.

Next, at block 806, the system may determine, for each technologyincident of the plurality of technology incidents, an impact factorbased at least on the operational impact. The impact factor may be aglobally applicable scale that helps ascertain the relative impacts ofthe technology incidents. The impact factor may be a numerical value, analphabetical rating, or any other suitable scale.

Subsequently, the system may augment the technology identifier data ofeach record of the plurality of records with the determined impactfactor, at block 808. In some embodiments, the system may add additionaldata fields containing the determined impact factor and/or thedetermined operational impact for each of the technology incidentrecords, based on retrieved rules from the categorical context database.The system may then encode each of the plurality of records into encodedrecords comprising encoded words of predetermined characters, at block810. Here the system may transform, the technology identifier data eachdata field of the plurality of data fields into binary values andutilize a categorical data encoding algorithm to compress the binaryvalues and generate encoded records, similar to categorical dataencoding of process flow 500. The system may further store an encodedrecord, for each record of the plurality of records, in the activityrecord database, wherein the encoded record comprises the encoded wordcorresponding to the plurality of data fields associated with thetechnology incident. These encoded records with the impact factorsand/or operational impacts may be utilized for determining whethertechnology change activities will cause technology incidents, andevaluating the impact of such technology change incidents, describedlater on with respect to process flows 900 through 1200.

In some embodiments, the system may utilize the impact factors and/orthe operational impacts in conjunction with the incident counts toevaluate technology stability. For instance, an enterprise may beassociated with one or more first technology incidents. These incidentsmay comprise a high impact, with a first incident count in apredetermined time period. For example, the first technology incidentsmay be directed to job batch data transmission issues with a highoperational impact/impact factor. The system may undertake steps toevaluate and mitigate these first incidents by initiating suitabletechnology restoral actions. However, the entity may also be associatedwith a plurality of second technology incidents, with a lower impactthat occur more frequently. For example, the second incidents may bedirected to capacity issues that have a low impact, which occur oftenresulting in a high incident count. Merely evaluating the incidentsbased on cost would preclude the system from considering the frequentlow impact incidents. However, since the stability analysis if thepresent invention comprises evaluation of impact in conjunction withincident counts, the aggregate impact of these second incidents may bedetermined for a predetermined time period. Thereby, the system and/orthe user may be able to analyze these frequently occurring incidents anddetermine appropriate restoral actions. In some embodiments, the systemmay initiate, automatically, the implementation of at least one restoralaction based on the aggregate impact factor being greater than an impactthreshold value, the incident count being greater than an incidentfrequency, the type of incident, the type of technology resourcesimpacted and/or the incident priorities. For example, the at least onerestoral action may refer to technology change activities/technologycorrection activities, commencing/discontinuing operations of relatedtechnology resources, and the like to minimize the aggregate impact ofincidents, to prevent the impact, reschedule the incident such that theimpact is moved to a different time period, and/or otherwise mitigatethe impact.

Additionally, stability analysis may be utilized for comparativeevaluation of technology resources. For example, based on incidentcounts of the process flow 700A, the system may ascertain that a firsttechnology application has a first number of incidents. The system mayfurther determine a second technology application with a similar numberof incidents. Although, the number of incidents are relatively similarthe aggregate impact of the incidents, evaluated using the stabilityanalysis may be vastly different.

The system may perform stability analysis for a desired subset of thetechnology incidents or all incidents. Here, the system may receive aretrieval request for retrieving one or more records from an activityrecord database from a user device, wherein the retrieval requestcomprises one or more technology criteria terms. The system maydetermine numeric values for criteria terms, determine decoding divisorsand retrieve one or more pertinent records in a method similar to thatdescribed with respect to FIGS. 7A and 7B. The system may similarlydetermine counts (total counts and categorical counts) of technologyidentifier data associated with the one or more retrieved records. Thesystem may determine an aggregate impact factor associated with the oneor more retrieved records, based on aggregating the impact factors ofthe one or more retrieved records. The system may also determineaggregate categorical impact factors for incidents associated with theauxiliary categories.

The system may then generate one or more technology interfaces of thetechnology identifier data associated with the one or more retrievedrecords, based at least on the determined aggregate impact factor andthe categorical impact factors. These interfaces may be similar to thosedescribed with respect to FIG. 7B. For example, the system may constructa contextual visual element 734 directed to various incident causes. Inthis regard, the sectors of the pie chart may be constructed based onthe relative categorical impacts of the various incident causes. Thecategorical impacts may be determined based on the individualoperational impacts of the incidents, for each incident cause typeand/or the number of incidents for the particular cause. The system mayalso transmit control instructions to a user device, that are configuredto cause the user device to present the one or more technologyinterfaces on a display of the user device.

Technology Change Evaluation

As noted previously, the technology configuration system 106 or “thesystem” is typically configured to evaluate whether a future technologychange event/activity may cause technology incidents and what thepotential impact of any such incidents may be. It is noted thattechnology change activities may be henceforth referred to as technologychange events or change events, and technology incidents may be referredto as incidents. In order to predict whether future change events maycause an incident, the technology configuration system 106 may initiallyevaluate data related to historical information technology operationalactivities in order to build an incident predictive algorithm. Thisincident predictive algorithm may then be used to evaluate thelikelihood that future change events may cause an incident.

In this regard, FIG. 9A depicts a method 900 of building an incidentpredictive model that may be performed by the technology configurationsystem 106 (e.g., by the technology change evaluation module 148 and/orother modules within the technology configuration system 106).

Initially, at block 902, a plurality of encoded records regarding aplurality of historic information technology operational activities isretrieved, such as from the activity record database in the technologydatabase 108. Each encoded record of the plurality of encoded recordsmay comprise an encoded word(s) associated with the informationtechnology operational activity, similar to the encoded records ofprocess flows 500 and 600. The plurality of information technologyactivities may comprise technology incidents, technology changes,technology events, and other activities. In some embodiments, onlyencoded records related to a predefined time period may be retrieved.For example, encoded records related to the most recent month, sixmonths, year, or the like may be retrieved based on the decoding divisordetermined by the categorical data decoding module of process flow 600,and/or process flows 700A and 800. In some embodiments, the incidentpredictive model is dynamically constructed for every technology changeevaluation session, on a daily basis, or periodically, by utilizing themost current information technology operational activities anddetermining the most predictive aspects/fields of the activities.Therefore, this incident predictive model provides a higher predictivepower, and a higher capture rate of technology changes that may causetechnology incidents, in comparison with pre-determined algorithms orpre-determined prediction models.

At block 904, the encoded records are decoded into a plurality ofdecoded records. The steps for decoding encoded records are describedabove in more detail and depicted in FIG. 6 of process flow 600. Asdescribed above, each of the decoded records typically includes a binaryvalue in each of a plurality of data fields, before transformation ofthe binary values into technology identifier data. One or more of thedata fields may relate to whether one of the historic informationtechnology operational activities is associated with (e.g., caused) aprior technology incident and/or is associated with a particular type ofprior technology incident. The determination of the relationshipsbetween information technology operational activities may be performedsimilar to the process flows 200A-B and this data may be used toconstruct the one or more data fields describing the related recordssimilar to process flow 300. Other data fields may typically relate tocategories of technology resources, technology motivators, technologyactions, timestamps, locations, and other aspects of the technologyincidents, as discussed previously. The technology resources involved ina technology incident, the technology motivator causing the incident,the technology actions being performed and other aspects of thetechnology incident stored in the plurality of data fields may bereferred to as exposure factors. In some embodiments, the system maydecode at least portions/encoded words of a historical record that arerelated to relationship between the activity of the record and one ormore incidents, that are related to impact categorical groups, or areotherwise required for technology change evaluation. While in otherembodiments, decoding the records may entail determining total countsand categorical counts of required technology identifier data (forexample, impact data, relationship data, technology resource data andthe like) by constructing suitable divisors, without converting thebinary values of the encoded records into textual data.

Once the retrieved records have been decoded, at block 906, the decodedrecords are then processed to create an incident predictive algorithmthat can be used to predict whether a technology change event will causea technology incident. Creating the incident predictive algorithmtypically involves determining which of the data fields correlate with aparticular data field of interest. The data field of interest typicallydefines whether a historic information technology operational activityis associated with a prior technology incident or a particular type ofprior technology incident. The decoded records are typically processedusing a technology incident predictive model to create the incidentpredictive algorithm. In other words, the technology incident predictivemodel may recognize which data fields correlate with a particular datafield of interest (e.g., whether the historic information technologyoperational activities are associated with a prior technology incident).In this regard, in some embodiments, the technology incident predictivemodel may employ a neural network that may be trained to recognize whichdata fields correlate with a particular data field of interest. Althougha technology incident predictive model as described in more detailherein is typically employed, other techniques that may be used todetermine which of the data fields correlate with a particular datafield of interest (e.g., neural networks, decision trees, or regressionanalysis) are within the scope of the present invention. Blocks906A-906D, depict sub-steps that are typically performed in order tobuild the incident predictive algorithm.

At block 906A, a periodicity test is typically performed. During theperiodicity test, the decoded records are processed (e.g., using thetechnology incident predictive model) to determine a testing timeperiod. As noted, the decoded records may relate to a predetermined timeperiod. This predetermined time period may be incrementally altered(e.g., on a monthly, weekly, and/or daily basis) to identify the timeperiod whose associated records best correlate (e.g., have the highestcorrelation coefficient and R-squared value) with prior technologyincidents. In other words, the decoded records may be processed todetermine the time period whose associated records have the highestpredictive power for determining whether a technology change event willcause a technology incident. The time period with the most predictivepower is then used as the testing time period.

Next, at block 906B, a field selection test is typically performed.During the field selection test, decoded records corresponding to thetesting time period are processed (e.g., using the technology incidentpredictive model) to determine a set (or subset) of data fields toemploy in the incident predictive algorithm. In order to determine theset of data fields to employ in the incident predictive algorithm,varying combinations of the data fields are processed to identify whichcombination of the data fields best correlates (e.g., has the highestcorrelation coefficient and R-squared value) with the data field ofinterest. The combination of data fields with the highest predictivepower (e.g., the combination that best correlates with the data field ofinterest) is then typically used as the set of data fields to employ inthe incident predictive algorithm.

In some embodiments, the data fields may be grouped into groups of datafields, where the data fields within a group relate to the same factor.For example, the data fields within a group may relate to technologyresources being affected by the activity, technology motivatorsinitiating the activity, technology actions being performed and otheraspects of the activities. Varying combinations of these groups may thenbe processed to identify which combination of these groups bestcorrelates with the data field of interest. The combination of thesegroups with the highest predictive power may then be used as the set ofdata fields to employ in the incident predictive algorithm.

At block 906C, a field weight test is typically performed. During thefield weight test, decoded records corresponding to the testing timeperiod are processed (e.g., using the technology incident predictivemodel) to determine a weight factor to apply to each data field withinthe set (or subset) of data fields determined to have the mostpredictive power as described above. Typically, in order to determinethe weight factor to apply to a particular data field, an initial weightfactor of one (1) is assigned. This initial weight factor is thenincrementally increased and/or decreased to determine the weight factorthat has the most predictive power (e.g., the weight factor that bestcorrelates with the data field of interest). The weight factor with themost predictive power is then used in the incident predictive algorithm.This process is then typically repeated for each data field within theset of data fields to determine a weight factor to apply to each datafield.

At block 906D, an aggregate weight test is typically performed. Duringthe aggregate weight test, decoded records corresponding to the testingtime period are processed (e.g., using the technology incidentpredictive model) to determine an aggregate weight factor to apply tothe set of data fields determined to have the most predictive power asdescribed above. Typically, in order to determine the aggregate weightfactor, an initial weight factor of one (1) is assigned. This initialweight factor is then incrementally increased and/or decreased todetermine the weight factor that has the most predictive power (e.g.,the weight factor that best correlates with the data field of interest).The weight factor with the most predictive power is then used as anaggregate weight factor in the incident predictive algorithm.

The set of data fields determined to have the most predictive power,along with the determined weight factor for each field and thedetermined aggregate weight factor, is then typically used within theincident predictive algorithm.

After the incident predictive algorithm has been created, at block 908,the incident predictive algorithm may be updated on a periodic basis. Asnoted, the initial set of encoded records that are processed to createthe incident predictive algorithm may be encoded records related to themost recent month, six months, year, or the like. Accordingly, the stepsdescribed above with respect to blocks 902-908 may be repeated on aperiodic basis (e.g., on a daily, weekly, or monthly basis) so that theincident predictive algorithm is based on the most recent historicinformation technology operational activities.

As noted, the incident predictive algorithm may relate to predicting thelikelihood of a particular type of technology incident. Accordingly, theabove described process may be repeated for different types oftechnology incidents.

FIG. 9B, provides an illustration 920 of the field selection test, thefield weight test and the aggregate weight test of steps 906B-906D, forone instance of the incident predictive algorithm. Initially, theincident predictive model may perform the field selection test of block906B. In this regard, the system may employ the decoded recordscorresponding to historical technology change activities 922 of thetesting time period determined by the periodicity test. Although,historical activities 1-5 are illustrated for this example, the testingtime period may include more or fewer records (for example, 100, 5000,100,000 records and the like). These records may be associated withhistorical technology change events, and/or historical technologyincidents. As mentioned previously, each record may be associated with aplurality of data fields. The system may determine the predictive powerof all or some of the data fields. In some instances, the system maydetermine/recognize the one or more data fields or categorical groups ofdata fields 922a-c, that are relevant to determining whether atechnology change event or activity will cause a technology incident.Each of the one or more data fields or categorical groups of data fields922a-c, may relate to one or more factors that help determine whethertechnology change event or activity will cause a technology incident,like technology resources being affected by the activity, technologymotivators initiating the activity, technology actions being performed,target technology resources, type of impacted technology resources, andother factors of the activities.

The system may then determine a relative predictive value 926, or RPV,for each of the one or more data fields 922a-c of each record. Therelative predictive value may be a measure of how critical or importantthe factor of the data field is to causing a technology incident. Therelative predictive value may be a percentage value, a fraction or anyother numerical value. In some embodiments, the system may peruse thehistorical technology change activities 922 from the determined timeperiod to determine a first count or number of first activities thatinvolved the same technology identifier data as the data field of therecord. The system may then determine a second count of activities ofthe portion of first activities involving the same data fieldidentifiers that caused or are otherwise associated with an incident.The system may then determine the relative predictive value 926, foreach data field of each record, directed to the portion of thehistorical activities involving the data field that caused an incident,by computing a ratio of the second count and the first count (e.g., thesecond count divided by the first count). For example, data field 1,922a of activity record 1 may be related to a specific targetapplication. Here, the system may determine the relative predictivevalue RPV1.1 for the data field comprising a numerical value of thepercentage of historical activities involving the specific targetapplication that caused a technology incident. These determined relativepredictive values 926 for the data fields typically remain the same forthe various iterations described below.

The system may then determine which combination of the data fields 922 ahas the highest predictive power 932. In this regard, the system mayperform multiple iterations 924, by assigning various weights 928 to thedata fields, to determine the most predictive field set. For example,for a particular pattern 2/iteration 924 b, the system may assignweights 0, 1, and 0 to the respective data fields, thereby consideringonly the data field 2 for the iteration. In another instance, the systemmay assign values of 1 to some or all the data fields to evaluate theircollective predictive powers, as illustrated by pattern 3, 924 c. For aparticular iteration 924, the system may then compute an aggregatepredictive value 930, for each record, by aggregating the relativepredictive values 926 for the data fields of the record, based on theweights of the iteration. For example, the aggregate predictive value930, APV3.a, of activity 3 may be the same as the relative predictivevalue RPV3.3, since the weights 928 assigned to the data fields 1 and 2are zero in the iteration 924 a. While, the aggregate predictive value930, APV4.c, of activity 4 may be the average of the relative predictivevalues RPV4.1, RPV 4.2 and RPV 4.3, for the iteration 924 c.

The system may assign a target value 931, for each of activity record,based on determining whether the historical technology change activityassociated with the record caused a technology incident. Typically, thesystem may assign a value of 1 to the activities that caused anincident, a value of 0 to those that did not. As noted, each activityrecord related to a historical change activity may include a data fieldthat defines whether a historic information technology operationalactivity is associated with a prior technology incident, the targetvalue 931 may be the information contained in such data field. Next, foreach iteration 924 a-c, the system may determine the field setpredictive power value 932, based on the aggregate predictive values 930of the iteration, and/or the target value 931 indicating whether or noteach activity caused an incident. In this regard, the predictive powervalue 932, may be a correlation coefficient and/or R-squared value,depicting how well the combination of data fields and the associatedweights correlate to the historical incidence of the technologyincidents, i.e., the target value 931. The system may determine the bestcombination of data fields, and hence the weights or the weight factorbased on the predictive power value 932, at step 906C. For example,based on determining that iteration 924 b has the best predictive powervalue PPVb of all the predictive power values of the iterations(PPVa-c), the system may determine that data field 2 has the mostpredictive power and hence determine weights or a weight factor of 0, 1and 0. This determined weight factor (or one or more of the weights) areincrementally increased and/or decreased to determine the weight factorthat has the most predictive power at steps 906C. Typically, the systemmay only incrementally increase and/or decrease the non-zero weightfactors. The set of data fields determined to have the most predictivepower, along with the determined weight factor for each field and thedetermined aggregate weight factor, are then typically used within theincident predictive algorithm.

Once the incident predictive algorithm has been created, the incidentpredictive algorithm may be used (e.g., by the technology configurationsystem 106) to predict the likelihood that a future technology changeevent or a future technology change activity may cause a futuretechnology incident. Based on the likelihood that futures change eventsmay cause future technology incidents, the overall exposure to futuretechnology incidents for one or more future technology change events maybe determined. Accordingly, FIG. 10 depicts a method 1000 of determiningan exposure index associated with a particular future technology changeevent. The exposure index associated with a future technology changeevent is typically a value that reflects both the likelihood that such afuture technology change even may cause a future technology incident aswell as the potential impact of such future technology incident (e.g.,the potential cost of such future technology incident).

Initially, at block 1002, a change record related to a future technologychange event is retrieved (e.g., from the technology database 108). Thischange record may be encoded, and so the change record may be decoded asdescribed above in more detail and depicted in FIG. 6.

At block 1004, the change record related to the future technology changeevent is evaluated using the incident predictive algorithm. In thisregard, the change record may include information related to at leastsome of the same data fields used by records related to the historicinformation technology operational activities that were evaluated tocreate the incident predictive algorithm. Accordingly, information inthe change record related to the set of data fields determined to havethe most predictive power may be evaluated using the incident predictivealgorithm (e.g., using the field weight factors and the aggregate weightfactor) to determine the likelihood that the future technology changeevent will cause a future technology incident.

As an illustration, the system may retrieve a record directed to aparticular future technology change activity in an attempt to evaluatewhether the future technology change activity will cause a technologyincident. The system may then determine, for each data field of therecord, a data field incidence value. This data field incidence valuemay depict the likelihood of occurrence of the aspects of the particulardata field and/or the likelihood of the aspects of the data fieldcausing an incident. For example, for a data field with a specifictechnology resource A, the system may assign a high data field incidencevalue based on determining that the technology resource A has a highfrequency of use, has caused a high number of incidents preciously, oris most likely to be employed for the particular change activity. Thesystem may assign a low data field incidence value based on determiningthat the technology resource A is no longer utilized by the entity, orhas trigged very few incidents historically. In some embodiments, thedata field incidence value may be similar to the relative predictivevalue/RPV 926, of FIG. 9B. In this regard, the data field incidencevalue for a data field may be (i) the total number of historicaltechnology change activities (e.g., occurring during the time periodidentified by the periodicity test) having the same data field value andthat caused or are otherwise associated with an incident, divided by(ii) the total number of historical technology change activities (e.g.,occurring during the time period identified by the periodicity test)having the same data field value. Therefore, the system may generatedata field incidence values (A, B, C, D, . . . ) for the data fields ina record.

Next, the system may also determine the weights (W₁, W₂, W₃, W₄, . . . )associated with the data fields of the record for the particular futuretechnology change activity, based on the incident predictive model ofFIGS. 9A-9B. The weights (W₁, W₂, W₃, W₄, . . . ) may be the weights 928of FIG. 9B that are calculated during the field weight test. As notedabove, the data fields determined to have no or low predictive power maybe assigned a weight W of zero. The system may further determine theaggregate weight factor M, based on the aggregate weight test of Block906D. The system may then determine the likelihood that the futuretechnology change event will cause the future technology incident basedon at least the data field incidence values, the weights and theaggregate weight factor. In some embodiments the likelihood that thefuture technology change event will cause the future technology incidentis a result of computing the polynomial equation M(W₁.A±W₂.B±W₃.C± . . .). Although, the products are typically summed to determine thelikelihood of a technology incident, one or more products of the weightsand data field incident values may be subtracted based on the type ofchange activity, for example if the data field incident values relate torestoral actions. If there are different incident predictive algorithms,each related to a different type of technology incident, the changerecord may be evaluated using each incident predictive algorithm todetermine the likelihood that the future technology change event willcause the different types of future technology incidents.

Next, at block 1006, an impact of the future technology incident isdetermined. As noted, the impact of a technology incident typicallyreflects the cost of or other expense or harm caused by such technologyincident. The impact of the future technology incident is typicallydetermined by determining the impact of similar historic technologychange events. In this regard, the records related to historictechnology change events typically include information related to theimpact of prior technology incidents associated with (e.g., caused by)such similar historic technology change events. Such similar historictechnology change events may be identified by determining which historictechnology change events have characteristics in common with the futuretechnology change event. These common characteristics typically relateto the technology resources being affected, the type of technologyaction being performed, time and location where the incident occurred,and the like. Typically, the most frequent impact (or the most frequentoperational impact) of the technology incidents caused by the similarhistoric technology change events is used as the impact of the futuretechnology incident. However, in some circumstances (e.g., if the entitywishes to consider realistic worst case scenarios) the highest impact ofthe technology incidents caused by the similar historic technologychange events may be used as the impact of the future technologyincident. In some embodiments, the determination of impact at block 1006may be similar to that of process flow 800, or vice versa.

Finally, at block 1008, the exposure index is determined for the futuretechnology change event. Typically, the exposure index is equal to thelikelihood that the future technology change event will cause the futuretechnology incident multiplied by the determined impact of the futuretechnology incident.

In some embodiments, an exposure level may be determined for the futuretechnology change event. In this regard, the exposure index for thefuture technology change event may be compared to a predefined exposurelevel threshold (e.g., defined by a user or the entity). If the exposureindex for the future technology change event exceeds the predefinedexposure level threshold, then the future technology change event mayhave an elevated exposure level. However, if the exposure index for thefuture technology change event is below the predefined exposure levelthreshold, then the future technology change event may have a lowexposure level. Accordingly, if the exposure level for a futuretechnology change event is elevated, then the likelihood and impact oftechnology incidents that may occur as a result of the technology changeevent may be undesirably elevated. That said, in a particularembodiment, the future technology change event may only have an elevatedexposure level if (i) the exposure index for the future technologychange event exceeds the predefined exposure level threshold and (ii)the future technology change event is scheduled to occur during a timeperiod that has an elevated aggregate exposure level.

These steps may be repeated to determine an exposure index for multipleplanned future technology change events. Once the exposure index isdetermined for multiple future technology events, the overall exposureof the entity during different time periods to potential technologyincidents may be determined. Accordingly, FIG. 11 depicts a method ofdetermining the exposure to potential technology incidents duringdifferent time periods.

Initially, at block 1102, an exposure index for each of the futuretechnology change events is determined as described above and depictedin FIG. 10.

Next, at block 1104, a time period for each of the future technologychange events is determined. The time period is typically the day, week,month, or other suitable time period in which a future technology changeevent is scheduled to occur. In this regard, the change recordassociated with each future technology change event may include timinginformation concerning when the future technology change event isscheduled to occur, and so this timing information may be used todetermine the time period associated with each of the future technologychange events.

Based on the time period associated with each future technology changeevent, at block 1106, the exposure indices of the future technologychange events may be aggregated to determine an aggregate exposure indexfor each of a plurality of time periods. Each time period typicallyrefers to a particular day, week, month, or other suitable time period.Typically, the aggregate exposure index for a particular time period isthe sum of the exposure indices of the future technology change eventsscheduled to occur during such particular time period. That said, insome embodiments the exposure index of future technology change eventswhose likelihood of causing of a future technology incident is below anincident likelihood threshold may be discarded when calculating theaggregate exposure index for a particular time period. By way ofexample, incidents X, Y, and Z may be scheduled to occur during aparticular day, and an incident likelihood threshold of 20% may havebeen defined for use by the technology configuration system 106 fordetermining the aggregate exposure index for each day. The technologyconfiguration system 106 may determine that: incident X has an exposureindex of A and a 50% probability of causing a technology incident;incident Y has an exposure index of B and a 10% probability of causing atechnology incident; incident Z has an exposure index of C and a 35%probability of causing a technology incident. Accordingly, thetechnology configuration system 106 may discard the exposure index ofincident Y and determine that the aggregate exposure index of theparticular day is A+C.

At block 1108, an aggregate exposure level is typically determined foreach of the plurality of time periods. Typically, the aggregate exposureindex for each of the plurality of time periods is compared to apredefined aggregate exposure level threshold (e.g., defined by a useror the entity). If the aggregate exposure index for a particular timeperiod exceeds the predefined aggregate exposure level threshold, thensuch time period may have an elevated aggregate exposure level. However,if the aggregate exposure index for a particular time period is belowthe predefined aggregate exposure level threshold, then such time periodmay have a low aggregate exposure level. Accordingly, if the aggregateexposure level for a time period is elevated, then the aggregatelikelihood and impact of technology incidents that may occur as a resultof technology change events occurring during such time period may beundesirably elevated.

At block 1110, a user computing device (e.g., the user device 104) maybe prompted to display information regarding whether the aggregateexposure index for each of the plurality of time periods is elevated(e.g., exceeds the predefined aggregate exposure level threshold)through one or more technology interfaces. In this regard, thetechnology configuration system 106 may establish a communicationchannel with the user device 104 (e.g., with the user technologyapplication 122). Typically, the technology configuration system 106 mayprompt the user device 104 to display a technology user interfacecomprising graphical user interface (e.g., by sending electronicinstructions that cause or otherwise instruct the user device 104 todisplay the graphical user interface) that includes informationregarding whether the aggregate exposure index for each of the pluralityof time periods is elevated. In one embodiment, such graphical userinterface may include a graphical representation of one or more timeperiods (e.g., days) with an exposure level indicator proximate to oroverlaying at least a portion of the graphical representation of eachtime period. Each exposure level indicator reflects the determinedaggregate exposure index of its associated time period. For example,each exposure level indicator may have a color or pattern that isindicative of its associated time period's exposure level. By way offurther example, as depicted in FIG. 13, such graphical user interfacemay include a calendar, where each time period is a single day. Asdepicted in FIG. 13, days with a low aggregate exposure level may becolored in a first color, for example green, and days with an elevatedaggregate exposure level may be colored in a second color, for examplered. The foregoing notwithstanding, any way of graphically presenting(e.g., a line graph of FIG. 7B or other suitable graphicalrepresentation) the aggregate exposure level of one or more time periodsis within the scope of the present invention.

In some embodiments, the user computing device may also be prompted todisplay information regarding whether the exposure index for one or morefuture technology change events is elevated (e.g., exceeds thepredefined exposure level threshold), as illustrated by the technologyinterface 1400 of FIG. 14. This interface may be similar to the userinterface display 700B, described previously. The technology interfacemay comprise presentation of a graphical user interface to display whichfuture technology change events occurring within a particular timeperiod (e.g., day) have an elevated exposure level. For example, thegraphical user interface may comprise a contextual visual element 1440illustrating a plot of the aggregate exposure index 1442 for each day ofa week 1, 1444. The contextual visual element may further comprise oneor more predefined aggregate exposure level thresholds 1446 for the daysof the week. The system may also display another contextual visualelement 1450, illustrating a plot of the aggregate exposure index 1452for the week, computed by aggregating the exposure indices of each ofthe days of the week. The contextual visual element 1450 may furthercomprise one or more pre-determined aggregate exposure level thresholds1456, which may be employed by the user and/or the system is assessingwhether restoral actions should be implemented.

In some embodiments, the graphical user interface may be configured toallow a user (e.g., via the user device 104) to select one or more timeperiods, after which the graphical user interface may display whichfuture technology change events occurring within such time period(s)have an elevated exposure level. For example, based on receiving a userselection of Day 2, the system may present an activity record view 1460comprising the information technology operational activities that arescheduled to occur on Day 2. The activity record view 1460 may compriseone or more data fields of the records like activity ID 1462, activitydate 1463, target technology resource 1464, technology action 1465,location 1466, and entity organization 1470, and the like. Based on theexposure level thresholds and the aggregate exposure levels displayed bycontextual visual elements 1440 and 1450, the user may choose to modifyor reschedule the one or more activities using user input 1461. Here,the system may simulate in real time the changes to aggregate exposureindices based on the user's modifications, via the contextual visualelements 1440 and 1450. In addition to the exposure level, otherinformation regarding future technology change events may also bedisplayed in the graphical user interface, such as the potential impact1467 of future technology incidents caused by a future technology changeevent, the time period in which a future technology change event isscheduled to occur, whether steps have been taken to mitigate theexposure level of a future technology change event, and othercharacteristics of a future technology change event (e.g., thetechnology resources involved, the locations of the technology changeevents, and the like).

In some embodiments, the above steps described with respect to blocks1102-1110 may be automatically performed on a periodic basis (e.g.,daily or weekly) in order to periodically provide one or more users withinformation regarding the aggregate exposure level for a plurality oftime period. That said, in some instances, the above steps describedwith respect to blocks 1102-1110 may be automatically performed based onreceiving a request from a user (e.g., from the user device 104). Such arequest may define the time periods for which aggregate exposure levelinformation is provided.

In some embodiments, the technology configuration system 106 may beconfigured to simulate how changes to the timing of one or moreparticular future technology change events may impact the aggregateexposure level of various time periods. Accordingly, FIG. 12 depicts amethod 1200 of simulating changes to future technology change events.

At block 1202, a request is received from a user computing device (e.g.,the user device 104) to simulate one or more changes to the timinginformation related to one or more future technology change events. Thisrequest may be received after an aggregate exposure level is determinedfor one or more time periods and information related to the aggregateexposure level of the time periods is provided to the user computingdevice as described above with respect to blocks 1106-1110. Tofacilitate receipt of the request, the technology configuration system106 may have previously established a communication channel with theuser computing device. The request may be provided through the samegraphical user interface through which the aggregate exposure levelinformation is displayed. Accordingly, the graphical user interface maybe configured to allow a user to input changes to the timing informationrelated to one or more future technology change events that the userwould like the technology configuration system 106 to simulate.

Next, at block 1204, a simulated aggregate exposure index for each ofthe plurality of time periods is determined based on the change(s) tothe timing information related to the future technology change events.This determination may be performed automatically based on receiving theabove request. The simulated aggregate exposure index for each of theplurality of time periods is determined the same way the aggregateexposure index is determined as described above with respect to block1106, except that the change(s) to the timing information is taken intoaccount when determining which time period is associated with eachfuture technology change event for the purpose of determining thesimulated aggregate exposure index for each time period. For example, achange event may be scheduled to occur during a first time period, but arequest is received to simulate the change event occurring during asecond time period. Accordingly, such change event is assumed to occurduring the second time period, not the first time period, for purposesof calculating the simulated aggregate exposure index for the first timeperiod and the second time period.

At block 1206, a simulated aggregate exposure level is typicallydetermined for each of the plurality of time period. Typically, thesimulated aggregate exposure index for each of the plurality of timeperiods is compared to the predefined aggregate exposure levelthreshold. If the simulated aggregate exposure index for a particulartime period exceeds the predefined aggregate exposure level threshold,then such time period may have an elevated simulated aggregate exposurelevel. However, if the simulated aggregate exposure index for aparticular time period is below the predefined aggregate exposure levelthreshold, then such time period may have a low simulated aggregateexposure level. Accordingly, if the simulated aggregate exposure levelfor a time period is elevated, then the aggregate likelihood and impactof technology incidents that may occur as a result of technology changeevents occurring during such time period may be undesirably elevated.

At block 1208, the user computing device (e.g., the user device 104) maybe prompted to display information regarding whether the simulatedaggregate exposure index for each of the plurality of time periods iselevated (e.g., exceeds the predefined aggregate exposure levelthreshold). For example, the technology configuration system 106 maysend electronic instructions to the user computing device (e.g., over anestablished communication channel) that cause the user computing deviceto display a graphical user interface that includes informationregarding whether the simulated aggregate exposure index for each of theplurality of time periods is elevated. In one embodiment, such graphicaluser interface may include a graphical representation of one or moretime periods (e.g., days) with an exposure level indicator proximate toor overlaying at least a portion of the graphical representation of eachtime period. Each exposure level indicator reflects the determinedsimulated aggregate exposure index of its associated time period. Forexample, each exposure level indicator may have a color or pattern thatis indicative of its associated time period's exposure level (e.g.,green for time periods with a low simulated aggregate exposure level andred for time periods with an elevated simulated aggregate exposurelevel).

In some embodiments, the technology configuration system 106 may beconfigured to alter the timing information associated with futuretechnology change events. In a particular embodiment, the technologyconfiguration system 106 may receive a request from a user computingdevice (e.g., the user device 104) to alter the timing informationassociated with a future technology change event. For example, a usermay determine based on information received from the technologyconfiguration system 106 that a particular time period has anundesirably high aggregate exposure index, and so the user may wish tomove one or more future technology change events scheduled to occurduring such time period to different time periods. By way of furtherexample, a user may wish to implement a simulated change to the timinginformation related to one or more future technology change events. Tofacilitate receipt of the request, the technology configuration system106 may have previously established a communication channel with theuser computing device. The request may be provided through the samegraphical user interface through which the aggregate exposure levelinformation is displayed. The graphical user interface may be configuredto allow a user to input changes to the timing information related toone or more future technology change events. Once the request has beenreceived, the technology configuration system 106 will then typicallyupdate the timing information in the change record associated with thefuture technology change event.

In some embodiments, the technology configuration system 106 mayinitiate implementation of one or more technology change events, basedon the simulated aggregate exposure level for each of the plurality oftime periods. Here, the system may automatically implement the one ormore technology change events during time periods without elevatedaggregate exposure index. In some embodiments, the system mayautomatically implement the one or more technology change events in aparticular time period, based on determining that the implementation ofthe technology change events may not cause a high aggregate exposureindex for the time period. The technology configuration system 106 mayimplement technology change events like automatic applicationinstallations, software updates, activation/deactivation of technologydevices and processes, modification in the settings of technologyinfrastructure and the like. In this regard, the technologyconfiguration system 106 may transmit control signals to one or moretechnology resources to cause the implementation of the change events.

In some embodiments, the technology configuration system 106 may beconfigured to stop the implementation of future technology changeevents. In a particular embodiment, the technology configuration system106 may receive a request from a user computing device (e.g., via agraphical user interface) to stop implementation of a particular futuretechnology change event. For example, the user may determine that thefuture technology change event has an undesirable high exposure index orcauses a particular time period to have an undesirably high aggregateexposure index. Once such a request has been received, the technologyconfiguration system 106 may stop implementation of the futuretechnology change event, such as by changing timing informationassociated with the future technology change event so that the futuretechnology change event is no longer scheduled to occur and/or byrevoking any permits (e.g., issued by the entity) that are needed toimplement the future technology change event. In another particularembodiment, the technology configuration system 106 may be configured toautomatically stop implementation of a particular future technologychange event based upon determining that certain circumstances exist,such as determining that (i) the exposure index for the futuretechnology change event exceeds a defined threshold or (ii)implementation of the future technology change event within a particulartime period will cause such time period to have an aggregate exposureindex above a defined threshold. In this regard, a graphical userinterface provided to a user computing device may be configured to allowa user to define an exposure threshold and/or an aggregate exposurethreshold for a particular time period, which the technologyconfiguration system 106 may use to determine whether to stopimplementation of particular future technology change events. Based ondetermining that such circumstances exist, the technology configurationsystem 106 may stop implementation of the future technology changeevent, such as by changing timing information associated with the futuretechnology change event so that the future technology change event is nolonger scheduled to occur and/or by revoking any permits that are neededto implement the future technology change event.

In some embodiments, the technology configuration system 106 may beconfigured to evaluate the incident predictive algorithm based on one ormore algorithm goals. One goal may relate to percentage of futuretechnology change events identified as having an elevated exposurelevel. In this regard, it may be desirable that the number of futuretechnology change events identified as having an elevated exposure levelbe within defined upper and lower bounds, because if the number offuture technology change events having an elevated exposure level isbelow such lower bounds, then the incident predictive algorithm may beunder-inclusive in identifying such future technology change events, andif the number of future technology change events having an elevatedexposure level is above such upper bounds, then the incident predictivealgorithm may be over-inclusive in identifying such future technologychange events (i.e., those future technology change events having anelevated exposure level). Another goal may relate to the percentage offuture technology change events identified as having an elevatedexposure level that, once implemented, actually cause a technologyincident. This may be determined, for instance using the incident countsof process flow 800. In this regard, it may be desirable that thepercentage of future technology change events identified as having anelevated exposure level that, once implemented, actually cause atechnology incident be above a defined threshold, because if thispercentage is too low, then the incident predictive algorithm may beidentifying too many future technology change events as having anelevated likelihood of causing a technology incident. Yet another goalmay relate to the percentage of future technology change events notidentified as having an elevated exposure level that, once implemented,actually cause a technology incident. In this regard, it may bedesirable that the percentage of future technology change eventsidentified as not having an elevated exposure level that, onceimplemented, actually cause a technology incident be below a definedthreshold, because if this percentage is too high, then the incidentpredictive algorithm may not be identifying all of the future technologychange events that could reasonably cause a technology incident. Thetechnology configuration system 106 may be configured to provide areport to one or more user computing devices with results indicating howwell the incident predictive algorithm is meeting such goals. Based onhow well these goals are being met, a user may adjust the incidentpredictive algorithm, the predefined exposure level threshold, and/orthe predefined aggregate exposure level threshold in an effort to bettermeet such goals.

In accordance with embodiments of the invention, the term “module” withrespect to a system may refer to a hardware component of the system, asoftware component of the system, or a component of the system thatincludes both hardware and software. As used herein, a module mayinclude one or more modules, where each module may reside in separatepieces of hardware or software.

Although many embodiments of the present invention have just beendescribed above, the present invention may be embodied in many differentforms and should not be construed as limited to the embodiments setforth herein; rather, these embodiments are provided so that thisdisclosure will satisfy applicable legal requirements. Also, it will beunderstood that, where possible, any of the advantages, features,functions, devices, and/or operational aspects of any of the embodimentsof the present invention described and/or contemplated herein may beincluded in any of the other embodiments of the present inventiondescribed and/or contemplated herein, and/or vice versa. In addition,where possible, any terms expressed in the singular form herein aremeant to also include the plural form and/or vice versa, unlessexplicitly stated otherwise. Accordingly, the terms “a” and/or “an”shall mean “one or more,” even though the phrase “one or more” is alsoused herein. Like numbers refer to like elements throughout.

As will be appreciated by one of ordinary skill in the art in view ofthis disclosure, the present invention may include and/or be embodied asan apparatus (including, for example, a system, machine, device,computer program product, and/or the like), as a method (including, forexample, a business method, computer-implemented process, and/or thelike), or as any combination of the foregoing. Accordingly, embodimentsof the present invention may take the form of an entirely businessmethod embodiment, an entirely software embodiment (including firmware,resident software, micro-code, stored procedures in a database, or thelike), an entirely hardware embodiment, or an embodiment combiningbusiness method, software, and hardware aspects that may generally bereferred to herein as a “system.” Furthermore, embodiments of thepresent invention may take the form of a computer program product thatincludes a computer-readable storage medium having one or morecomputer-executable program code portions stored therein. In someembodiments, the operational data processor module 144, the technicallanguage processor module 145, the categorical data encoding module 146,dynamic categorical data decoding module 147, and/or technology changeevaluation module 148 may be referred to as a “module” stored in the atleast one memory device 140, comprising computer readable instructions142, that when executed by the at least one processor/processing device138, cause the at least one processor to perform one or more stepsdescribed with respect to FIGS. 2A-14. As used herein, a processor,which may include one or more processors, may be “configured to” performa certain function in a variety of ways, including, for example, byhaving one or more general-purpose circuits perform the function byexecuting one or more computer-executable program code portions embodiedin a computer-readable medium, and/or by having one or moreapplication-specific circuits perform the function.

It will be understood that any suitable computer-readable medium may beutilized. The computer-readable medium may include, but is not limitedto, a non-transitory computer-readable medium, such as a tangibleelectronic, magnetic, optical, electromagnetic, infrared, and/orsemiconductor system, device, and/or other apparatus. For example, insome embodiments, the non-transitory computer-readable medium includes atangible medium such as a portable computer diskette, a hard disk, arandom access memory (RAM), a read-only memory (ROM), an erasableprogrammable read-only memory (EPROM or Flash memory), a compact discread-only memory (CD-ROM), and/or some other tangible optical and/ormagnetic storage device. In other embodiments of the present invention,however, the computer-readable medium may be transitory, such as, forexample, a propagation signal including computer-executable program codeportions embodied therein.

One or more computer-executable program code portions for carrying outoperations of the present invention may include object-oriented,scripted, and/or unscripted programming languages, such as, for example,Java, Perl, Smalltalk, C++, SAS, SQL, Python, Objective C, JavaScript,and/or the like. In some embodiments, the one or morecomputer-executable program code portions for carrying out operations ofembodiments of the present invention are written in conventionalprocedural programming languages, such as the “C” programming languagesand/or similar programming languages. The computer program code mayalternatively or additionally be written in one or more multi-paradigmprogramming languages, such as, for example, F3.

Some embodiments of the present invention are described herein withreference to flowchart illustrations and/or block diagrams of apparatusand/or methods. It will be understood that each block included in theflowchart illustrations and/or block diagrams, and/or combinations ofblocks included in the flowchart illustrations and/or block diagrams,may be implemented by one or more computer-executable program codeportions. These one or more computer-executable program code portionsmay be provided to a processor of a general purpose computer, specialpurpose computer, and/or some other programmable data processingapparatus in order to produce a particular machine, such that the one ormore computer-executable program code portions, which execute via theprocessor of the computer and/or other programmable data processingapparatus, create mechanisms for implementing the steps and/or functionsrepresented by the flowchart(s) and/or block diagram block(s).

The one or more computer-executable program code portions may be storedin a transitory and/or non-transitory computer-readable medium (e.g. amemory) that can direct, instruct, and/or cause a computer and/or otherprogrammable data processing apparatus to function in a particularmanner, such that the computer-executable program code portions storedin the computer-readable medium produce an article of manufactureincluding instruction mechanisms which implement the steps and/orfunctions specified in the flowchart(s) and/or block diagram block(s).

The one or more computer-executable program code portions may also beloaded onto a computer and/or other programmable data processingapparatus to cause a series of operational steps to be performed on thecomputer and/or other programmable apparatus. In some embodiments, thisproduces a computer-implemented process such that the one or morecomputer-executable program code portions which execute on the computerand/or other programmable apparatus provide operational steps toimplement the steps specified in the flowchart(s) and/or the functionsspecified in the block diagram block(s). Alternatively,computer-implemented steps may be combined with, and/or replaced with,operator- and/or human-implemented steps in order to carry out anembodiment of the present invention.

While certain exemplary embodiments have been described and shown in theaccompanying drawings, it is to be understood that such embodiments aremerely illustrative of and not restrictive on the broad invention, andthat this invention not be limited to the specific constructions andarrangements shown and described, since various other changes,combinations, omissions, modifications and substitutions, in addition tothose set forth in the above paragraphs, are possible. Those skilled inthe art will appreciate that various adaptations, modifications, andcombinations of the just described embodiments can be configured withoutdeparting from the scope and spirit of the invention. Therefore, it isto be understood that, within the scope of the appended claims, theinvention may be practiced other than as specifically described herein.

INCORPORATION BY REFERENCE

To supplement the present disclosure, this application furtherincorporates entirely by reference the following commonly assignedpatent applications:

U.S. Patent Application Ser. No. Title Filed On 15/052,662 (nowpublished OPERATIONAL DATA Concurrently as U.S. patent application Pub.No. PROCESSOR Herewith 2017/0242895) 15/052,673 (now published TECHNICALLANGUAGE Concurrently as U.S. patent application Pub. No. PROCESSORHerewith 2017/0242896) 15/052,679 (now published TECHNICAL LANGUAGEConcurrently as U.S. patent application Pub. No. PROCESSORADMINISTRATION Herewith 2017/0242897) 15/052,689 (now published SYSTEMFOR CATEGORICAL Concurrently as U.S. patent application Pub. No. DATAENCODING Herewith 2017/0242629) 15/052,696 (now published SYSTEM FORCATEGORICAL Concurrently as U.S. patent application Pub. No. DATADYNAMIC DECODING Herewith 2017-0242630) 15/052,614 (now patentedCOMPUTERIZED SYSTEM FOR Concurrently as U.S. Pat. No. 10,019,486)ANALYZING OPERATIONAL Herewith EVENT DATA 15/052,628 (now patentedCOMPUTERIZED SYSTEM Concurrently as U.S. Pat. No. 10,067,984) FOREVALUATING Herewith TECHNOLOGY STABILITY 15/052,573 (now publishedCOMPUTERIZED SYSTEM FOR Concurrently as U.S. patent application Pub. No.EVALUATING THE LIKELIHOOD OF Herewith 2017/0243129) TECHNOLOGY CHANGEINCIDENT 15/052,583 (now published COMPUTERIZED SYSTEM FOR Concurrentlyas U.S. patent application Pub. No. EVALUATING THE IMPACT OF Herewith2017/0243130) TECHNOLOGY CHANGE INCIDENTS 15/052,587 (now publishedCOMPUTERIZED SYSTEM FOR Concurrently as U.S. patent application Pub. No.EVALUATING AND MODIFYING Herewith 2017/0243117) TECHNOLOGY CHANGE EVENTS

What is claimed is:
 1. A computerized system for simulating thelikelihood of technology change incidents, comprising: a computerapparatus including a processor, a memory, and a network communicationdevice; and a technology change evaluation module stored in the memory,executable by the processor, and configured for: determining a decodingdivisor; retrieving a plurality of encoded records regarding a pluralityof historic information technology operational activities from anactivity record database based on a division operation of the decodingdivisor and one or more encoded words of each encoded record of theplurality of encoded records, wherein each encoded word is associatedwith a technology operational activity and is divisible by the decodingdivisor, wherein the division operation yields a remainder of zero;decoding, using a categorical data decoding algorithm, each of theplurality of encoded records into a plurality of decoded records, eachof the decoded records comprising a binary value in each of a pluralityof data fields, the plurality of data fields including a first datafield defining whether one of the historic information technologyoperational activities is associated with a prior technology incident;transforming, for each decoded record of the decoded records, the binaryvalue associated with at least one data field of the plurality of datafields into technology identifier data; processing the decoded recordsusing a technology incident predictive model to produce an incidentpredictive algorithm for predicting whether a technology change eventwill cause a technology incident, the incident predictive algorithmdefining a subset of the data fields and a weight factor for each datafield in the subset of the data fields; retrieving a plurality of changerecords, each change record being related to one of a plurality offuture technology change events, each change record comprising changeinformation related to one or more of the plurality of data fields, thechange records comprising timing information related to the futuretechnology change events; evaluating the change information in thechange records using the incident predictive algorithm to determine alikelihood that each of the future technology change events will cause afuture technology incident; determining an impact of each futuretechnology incident; determining an exposure index for each of theplurality of future technology change events based on (i) determining alikelihood that each of the future technology change events will cause afuture technology incident and (ii) determining an impact of each futuretechnology incident; aggregating the exposure indices of the pluralityof future technology change events to determine an aggregate exposureindex for each of a plurality of time periods based on the timinginformation related to the future technology change events; receiving arequest from a user computing device to simulate a change to the timinginformation related to the future technology change events; determininga simulated aggregate exposure index for each of the plurality of timeperiods based on (i) the exposure indices for each of the plurality offuture technology change events and (ii) the change to the timinginformation related to the future technology change events; determiningwhether the simulated aggregate exposure index for each of the pluralityof time periods exceeds a predefined aggregate exposure level threshold;prompting the user computing device to display a graphical userinterface, the graphical user interface being configured to displayinformation regarding whether the simulated aggregate exposure index foreach of the plurality of time periods exceeds the predefined aggregateexposure level threshold.
 2. The computerized system according to claim1, wherein: the incident predictive algorithm defines an aggregateweight factor for the subset of the data fields; the plurality ofdecoded records are associated with a first time period; the technologychange evaluation module is configured for incrementally altering thefirst time period to identify a second time period that correlates withthe first data field, the second time period being associated with asubset of the plurality of decoded records; processing the decodedrecords using the technology incident predictive model to produce theincident predictive algorithm comprises: processing the subset of theplurality of decoded records using the technology incident predictivemodel to produce the incident predictive algorithm; performing a fieldselection test to identify the subset of the data fields, the subset ofthe data fields correlating with the first data field; performing afield weight test to identify the weight factor for each data field inthe subset of data fields, each weight factor correlating with the firstdata field; and performing an aggregate weight test to identify theaggregate weight factor for the subset of the data fields, the aggregateweight factor correlating with the first data field.
 3. The computerizedsystem according to claim 1, wherein the technology change evaluationmodule is configured for: identifying historic technology change eventshaving characteristics in common with the future technology changeevent; determining a most frequent impact of prior technology incidentsassociated with the historic technology change events; wherein theimpact of the future technology incident is the most frequent impact ofthe prior technology incidents associated with the historic technologychange events.
 4. The computerized system according to claim 1, whereinthe technology change evaluation module is configured for: identifyinghistoric technology change events having characteristics in common withthe future technology change event; determining a highest impact ofprior technology incidents associated with the historic technologychange events; wherein the impact of the future technology incident isthe highest impact of the prior technology incidents associated with thehistoric technology change events.
 5. The computerized system accordingto claim 1, wherein the technology change evaluation module isconfigured for: receiving a user request via the graphical userinterface to implement the change to the timing information related tothe future technology change events; automatically altering the timinginformation contained in the change records related to the futuretechnology change events based on the change to the timing informationrelated to the future technology change events.
 6. The computerizedsystem according to claim 1, wherein the technology change evaluationmodule is configured for: receiving a user selection via the graphicaluser interface of a first time period; based on the change to the timinginformation related to the future technology change events, determiningone or more first future technology change events simulated to occurduring the first time period; determining that the exposure index of oneor more of the first future technology change events exceeds apredefined exposure level threshold; and prompting the user computingdevice to display via the graphical user interface informationindicating that the exposure index of the one or more first futuretechnology change events exceeds the predefined exposure levelthreshold.
 7. A computer program product for simulating the likelihoodof technology change incidents, comprising a non-transitorycomputer-readable storage medium having computer-executable instructionsfor: determining a decoding divisor; retrieving a plurality of encodedrecords regarding a plurality of historic information technologyoperational activities from an activity record database based on adivision operation of the decoding divisor and one or more encoded wordsof each encoded record of the plurality of encoded records, wherein eachencoded word is associated with a technology operational activity and isdivisible by the decoding divisor, wherein the division operation yieldsa remainder of zero; decoding, using a categorical data decodingalgorithm, each of the plurality of encoded records into a plurality ofdecoded records, each of the decoded records comprising a binary valuein each of a plurality of data fields, the plurality of data fieldsincluding a first data field defining whether one of the historicinformation technology operational activities is associated with a priortechnology incident; transforming, for each decoded record of thedecoded records, the binary value associated with at least one datafield of the plurality of data fields into technology identifier data;processing the decoded records using a technology incident predictivemodel to produce an incident predictive algorithm for predicting whethera technology change event will cause a technology incident, the incidentpredictive algorithm defining a subset of the data fields and a weightfactor for each data field in the subset of the data fields; retrievinga plurality of change records, each change record being related to oneof a plurality of future technology change events, each change recordcomprising change information related to one or more of the plurality ofdata fields, the change records comprising timing information related tothe future technology change events; evaluating the change informationin the change records using the incident predictive algorithm todetermine a likelihood that each of the future technology change eventswill cause a future technology incident; determining an impact of eachfuture technology incident; determining an exposure index for each ofthe plurality of future technology change events based on (i)determining a likelihood that each of the future technology changeevents will cause a future technology incident and (ii) determining animpact of each future technology incident; aggregating the exposureindices of the plurality of future technology change events to determinean aggregate exposure index for each of a plurality of time periodsbased on the timing information related to the future technology changeevents; receiving a request from a user computing device to simulate achange to the timing information related to the future technology changeevents; determining a simulated aggregate exposure index for each of theplurality of time periods based on (i) the exposure indices for each ofthe plurality of future technology change events and (ii) the change tothe timing information related to the future technology change events;determining whether the simulated aggregate exposure index for each ofthe plurality of time periods exceeds a predefined aggregate exposurelevel threshold; prompting the user computing device to display agraphical user interface, the graphical user interface being configuredto display information regarding whether the simulated aggregateexposure index for each of the plurality of time periods exceeds thepredefined aggregate exposure level threshold.
 8. The computer programproduct according to claim 7, wherein: the incident predictive algorithmdefines an aggregate weight factor for the subset of the data fields;the plurality of decoded records are associated with a first timeperiod; the non-transitory computer-readable storage medium hascomputer-executable instructions for incrementally altering the firsttime period to identify a second time period that correlates with thefirst data field, the second time period being associated with a subsetof the plurality of decoded records; processing the decoded recordsusing the technology incident predictive model to produce the incidentpredictive algorithm comprises: processing the subset of the pluralityof decoded records using the technology incident predictive model toproduce the incident predictive algorithm; performing a field selectiontest to identify the subset of the data fields, the subset of the datafields correlating with the first data field; performing a field weighttest to identify the weight factor for each data field in the subset ofdata fields, each weight factor correlating with the first data field;and performing an aggregate weight test to identify the aggregate weightfactor for the subset of the data fields, the aggregate weight factorcorrelating with the first data field.
 9. The computer program productaccording to claim 7, wherein the non-transitory computer-readablestorage medium has computer-executable instructions for: identifyinghistoric technology change events having characteristics in common withthe future technology change event; determining a most frequent impactof prior technology incidents associated with the historic technologychange events; wherein the impact of the future technology incident isthe most frequent impact of the prior technology incidents associatedwith the historic technology change events.
 10. The computer programproduct according to claim 7, wherein the non-transitorycomputer-readable storage medium has computer-executable instructionsfor: identifying historic technology change events havingcharacteristics in common with the future technology change event;determining a highest impact of prior technology incidents associatedwith the historic technology change events; wherein the impact of thefuture technology incident is the highest impact of the prior technologyincidents associated with the historic technology change events.
 11. Thecomputer program product according to claim 7, wherein thenon-transitory computer-readable storage medium has computer-executableinstructions for: receiving a user request via the graphical userinterface to implement the change to the timing information related tothe future technology change events; automatically altering the timinginformation contained in the change records related to the futuretechnology change events based on the change to the timing informationrelated to the future technology change events.
 12. The computer programproduct according to claim 7, wherein the non-transitorycomputer-readable storage medium has computer-executable instructionsfor: receiving a user selection via the graphical user interface of afirst time period; based on the change to the timing information relatedto the future technology change events, determining one or more firstfuture technology change events simulated to occur during the first timeperiod; determining that the exposure index of one or more of the firstfuture technology change events exceeds a predefined exposure levelthreshold; and prompting the user computing device to display via thegraphical user interface information indicating that the exposure indexof the one or more first future technology change events exceeds thepredefined exposure level threshold.
 13. A computerized method forsimulating the likelihood of technology change incidents, comprising:determining, via a computer processor, a decoding divisor; retrieving,via a computer processor, a plurality of encoded records regarding aplurality of historic information technology operational activities froman activity record database based on a division operation of thedecoding divisor and one or more encoded words of each encoded record ofthe plurality of encoded records, wherein each encoded word isassociated with a technology operational activity and is divisible bythe decoding divisor, wherein the division operation yields a remainderof zero; decoding, via a computer processor, using a categorical datadecoding algorithm, each of the plurality of encoded records into aplurality of decoded records, each of the decoded records comprising abinary value in each of a plurality of data fields, the plurality ofdata fields including a first data field defining whether one of thehistoric information technology operational activities is associatedwith a prior technology incident; transforming, via a computerprocessor, for each decoded record of the decoded records, the binaryvalue associated with at least one data field of the plurality of datafields into technology identifier data; processing, via a computerprocessor, the decoded records using a technology incident predictivemodel to produce an incident predictive algorithm for predicting whethera technology change event will cause a technology incident, the incidentpredictive algorithm defining a subset of the data fields and a weightfactor for each data field in the subset of the data fields; retrieving,via a computer processor, a plurality of change records, each changerecord being related to one of a plurality of future technology changeevents, each change record comprising change information related to oneor more of the plurality of data fields, the change records comprisingtiming information related to the future technology change events;evaluating, via a computer processor, the change information in thechange records using the incident predictive algorithm to determine alikelihood that each of the future technology change events will cause afuture technology incident; determining, via a computer processor, animpact of each future technology incident; determining, via a computerprocessor, an exposure index for each of the plurality of futuretechnology change events based on (i) determining a likelihood that eachof the future technology change events will cause a future technologyincident and (ii) determining an impact of each future technologyincident; aggregating, via a computer processor, the exposure indices ofthe plurality of future technology change events to determine anaggregate exposure index for each of a plurality of time periods basedon the timing information related to the future technology changeevents; receiving, via a computer processor, a request from a usercomputing device to simulate a change to the timing information relatedto the future technology change events; determining, via a computerprocessor, a simulated aggregate exposure index for each of theplurality of time periods based on (i) the exposure indices for each ofthe plurality of future technology change events and (ii) the change tothe timing information related to the future technology change events;determining, via a computer processor, whether the simulated aggregateexposure index for each of the plurality of time periods exceeds apredefined aggregate exposure level threshold; prompting, via a computerprocessor, the user computing device to display a graphical userinterface, the graphical user interface being configured to displayinformation regarding whether the simulated aggregate exposure index foreach of the plurality of time periods exceeds the predefined aggregateexposure level threshold.
 14. The computerized method according to claim13, wherein: the incident predictive algorithm defines an aggregateweight factor for the subset of the data fields; the plurality ofdecoded records are associated with a first time period; thecomputerized method comprises incrementally altering the first timeperiod to identify a second time period that correlates with the firstdata field, the second time period being associated with a subset of theplurality of decoded records; processing the decoded records using thetechnology incident predictive model to produce the incident predictivealgorithm comprises: processing the subset of the plurality of decodedrecords using the technology incident predictive model to produce theincident predictive algorithm; performing a field selection test toidentify the subset of the data fields, the subset of the data fieldscorrelating with the first data field; performing a field weight test toidentify the weight factor for each data field in the subset of datafields, each weight factor correlating with the first data field; andperforming an aggregate weight test to identify the aggregate weightfactor for the subset of the data fields, the aggregate weight factorcorrelating with the first data field.
 15. The computerized methodaccording to claim 13, comprising: identifying historic technologychange events having characteristics in common with the futuretechnology change event; determining a most frequent impact of priortechnology incidents associated with the historic technology changeevents; wherein the impact of the future technology incident is the mostfrequent impact of the prior technology incidents associated with thehistoric technology change events.
 16. The computerized method accordingto claim 13, comprising: identifying historic technology change eventshaving characteristics in common with the future technology changeevent; determining a highest impact of prior technology incidentsassociated with the historic technology change events; wherein theimpact of the future technology incident is the highest impact of theprior technology incidents associated with the historic technologychange events.
 17. The computerized method according to claim 13,comprising: receiving a user request via the graphical user interface toimplement the change to the timing information related to the futuretechnology change events; automatically altering the timing informationcontained in the change records related to the future technology changeevents based on the change to the timing information related to thefuture technology change events.
 18. The computerized method accordingto claim 13, comprising: receiving a user selection via the graphicaluser interface of a first time period; based on the change to the timinginformation related to the future technology change events, determiningone or more first future technology change events simulated to occurduring the first time period; determining that the exposure index of oneor more of the first future technology change events exceeds apredefined exposure level threshold; and prompting the user computingdevice to display via the graphical user interface informationindicating that the exposure index of the one or more first futuretechnology change events exceeds the predefined exposure levelthreshold.